[Security Alert] Exposed API key(s) detected: OpenAI (classic), AWS Access Key, GitHub PAT (classic)

[hdhdn]

Hi,

An automated responsible-disclosure scan found pattern(s) matching the following API key type(s) in this file:

https://github.com/apisec-inc/mcp-audit/blob/40a0129ac03db5c9fa36c5eacbc08f09cd12c704/docs/RISK_SCORING.md

Keys detected

• OpenAI (classic) → revoke at https://platform.openai.com/api-keys
• AWS Access Key → revoke at https://console.aws.amazon.com/iam
• GitHub PAT (classic) → revoke at https://github.com/settings/tokens

Recommended actions

1. Revoke each key immediately using the links above
2. Remove the key(s) from the file and commit the change
3. Purge from git history — keys remain accessible in old commits even after deletion. Use git filter-repo or BFG Repo Cleaner
4. Rotate any dependent services that used these credentials

This is an automated alert. No keys were tested, validated, or used in any way. If this is a false positive, please close this issue.

---

Sent by a responsible disclosure scanner to help protect accidentally exposed credentials.
Note: A SECURITY.md was found in this repo — you may want to handle disclosure through that channel as well.