Credential hardcoded in source
A credential appears as a literal in source. Anything committed is in the repository's history, in every clone, and in every build artefact, so removing the line later does not revoke it. Read secrets from the environment or a secret manager, and rotate anything that has been committed.
high likely application source OWASP A07:2021 / CWE-798
What it looks like
HIGH likely Credential hardcoded in source A07:2021
app/lib/billing.ts:3:20
1 │ // FIXTURE: hardcoded-secret - Stripe live key prefix.
2 │ // Non-alphanumeric character keeps GitHub push protection from blocking the repo.
3 │ const STRIPE_KEY = 'sk_l***'
│ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ credential written into source
4 │
5 │ export async function charge(amountCents: number) {
From app/lib/billing.ts in the fixture suite.
The fixture test asserts this finding.
How to fix it
Move the value into an environment variable or a secret manager, and rotate it - once committed it is in the history and in every clone, so removing the line does not revoke it.
The fix for your framework
Choose the API used by your project.
- Next.js
- Nuxt
- NestJS
- Express
- Fastify
- Hono
- Koa
- Hapi
- Sails.js
- Astro
- Remix
- Gatsby
- SvelteKit
- TanStack Start
- SolidStart
- Elysia
Check your own repository
npx owlwarden scan --preset deep
npx owlwarden explain hardcoded-secret
explain prints the rule and fixes in the terminal. It does not
use the network.