misconfigurations:
  - id: KSV-0109
    paths:
      - "deploy/kubernetes/base/configmap.yaml"
    statement: >-
      RTC_TOKEN_ISSUER and the *_TTL values are public runtime metadata, not
      credentials. All RTC signing keys, provider credentials, and token key
      material are mounted from Kubernetes Secrets or the production CSI
      secret store.