This prose is not a Compose assignment: password: example.
It also says secret key without defining one.
The server README sentence that triggered the audit is reproduced here:
under `server/` carries anything that looks like a secret: this repository is
public, and the gitignore is a seatbelt, not the brakes.