GCP credential docs
For using the GCP using credential file, it suggests the following format:
{
"project": "",
"client_email": "",
"private_key": ""
}
But, as per this index.js line, one is expected to provide "project_id" and not "project"
Consequences: This mismatch is causing the "project" field provided to be ignored, hence effectively scans are not happening on the project even though it appears it's being scanned, since no error is raised. This can cause false negatives.
Suggestion: Add input validation to surface an explicit error when the required field is missing and rectify the documentation.
If this sounds correct, please assign this issue to me and I can raise the fix.