[Security Alert] Exposed API key(s) detected: AWS Access Key

[hdhdn]

Hi,

An automated responsible-disclosure scan found pattern(s) matching the following API key type(s) in this file:

https://github.com/docker/mcp-registry/blob/489ea6e19effa8146e14b334cb8500327782f34a/servers/awslabs-iam/server.yaml

Keys detected

• AWS Access Key → revoke at https://console.aws.amazon.com/iam

Recommended actions

1. Revoke each key immediately using the links above
2. Remove the key(s) from the file and commit the change
3. Purge from git history — keys remain accessible in old commits even after deletion. Use git filter-repo or BFG Repo Cleaner
4. Rotate any dependent services that used these credentials

This is an automated alert. No keys were tested, validated, or used in any way. If this is a false positive, please close this issue.

---

Sent by a responsible disclosure scanner to help protect accidentally exposed credentials.
Note: A .github/SECURITY.md was found in this repo — you may want to handle disclosure through that channel as well.

[Raj-spy]

Hi, thanks for raising this.

Has this been verified by the maintainers yet?
If it's still valid, I can help with removing the key and updating it to use environment variables or placeholders.

Please let me know how you'd like to proceed.