Description of the false positive

"Sensitive data returned by process environment is stored in a build artifact" triggers on create-react-app's default config (if it's been ejected) - where the included environment variables are filtered (namely only REACT_APP_*, as well as NODE_ENV and a few other hardcoded ones are included).

Filtering happens here: https://github.com/markspolakovs/lgtm-fp-repro/blob/main/config/env.js#L63-L104 (upstream at https://github.com/facebook/create-react-app/blob/master/packages/react-scripts/config/env.js#L71-L112)

URL to the alert on the project page on LGTM.com

First detected at https://lgtm.com/projects/g/UniversityRadioYork/WebStudio/snapshot/6dd662a7d1b348c6ae9a96de0a4da572dc15c21b/files/config/webpack.config.js#xa43c1ced1ab335a4:1.

Created a blank reproduction repo at https://github.com/markspolakovs/lgtm-fp-repro, alerted at https://lgtm.com/projects/g/markspolakovs/lgtm-fp-repro/snapshot/dea5a8b6c858947e154d8d90efe6e9c83bb95156/files/config/webpack.config.js#xa46abc5482033400:1

Repro repo steps:

$ yarn create react-app lgtm-fp-repro
$ cd lgtm-fp-repro
$ yarn eject
$ # <push to git and add to LGTM>