Security: Committed private keys in `uWebSockets/misc` trigger compliance failures

Author: segorCreated Feb 9, 2026Updated Feb 12, 2026
Labelslow priority

Problem

During a security audit of our dependencies, we identified committed private keys in the repository:

  • uWebSockets/misc/cert.pem
  • uWebSockets/misc/key.pem

While we understand these are likely used for testing and tooling, committing secrets to version control triggers high-severity alerts in enterprise compliance scanners (e.g., TruffleHog, GitHub Secret Scanning) and violates modern security protocols.

Supporting Standards

  • OWASP: The Secrets Management Cheat Sheet explicitly states that secrets should never be stored in version control.
  • NIST SP 800-57: Outlines strict requirements for protecting private keys to maintain the integrity of a system's security posture.

Suggested Resolution

We recommend removing these static files from the repository and instead generating them dynamically during the test or build bootstrap phase.

This would resolve compliance flags for all downstream users and align the library with "Secure by Design" industry standards.

Thank you for your work on this library!