Hardcoded Secrets and API Keys
API keys, passwords, tokens, and other secrets embedded directly in source code, configuration files, or client-side applications can be discovered by attackers through code repositories, reverse engineering, or static analysis.
Overview
Hardcoded secrets are one of the most common and dangerous security issues. Developers often embed API keys, database passwords, JWT signing secrets, and OAuth tokens directly in source code for convenience. These secrets end up in version control systems, compiled applications, or client-side bundles where attackers can easily discover them.
Types & Variants
Source Code Secrets
Secrets embedded directly in application source code.
Configuration File Secrets
Secrets in config files committed to version control.
Client-Side Exposure
API keys and tokens exposed in JavaScript bundles or mobile apps.
Impact
Unauthorized access to external services, cloud account compromise, data breach, financial loss from API abuse.
Examples
Hardcoded API Key
const API_KEY = "sk-live-abc123xyz456" const DB_PASSWORD = "production_p@ssw0rd"
Remediation
Use environment variables or secret management services (Vault, AWS Secrets Manager), scan repositories for secrets, implement pre-commit hooks, and rotate any exposed secrets immediately.
Use environment variables for all secrets
Use secret management services (HashiCorp Vault, AWS Secrets Manager)
Implement pre-commit hooks to scan for secrets
Add .env files to .gitignore
Rotate any secrets that have been exposed
Use different credentials for each environment
Related SuperClue scanner checks
These scanner checks look for signs of Hardcoded Secrets and API Keys. What a scan can confirm from outside depends on your application.
Scan a domain you have verified with up to 350 modules, paid in credits.
See how website scanning works