Home / Knowledge hub / Hardcoded secret
Knowledge hub
Hardcoded secret
A password, API key or token written straight into source code.
What it means
A hardcoded secret is a password, API key, token or certificate written into source code instead of supplied at run time. MITRE tracks it as CWE-798, use of hard-coded credentials. It happens because it works. Somebody needed the code to reach another system, and nobody came back to it.
The trouble is where the value then lives. Repositories get cloned, forked, backed up and shared with contractors. Version control keeps every earlier state, so removing the line today leaves yesterday's commit intact.
Why it matters
Everybody who can read the repository holds that credential. The group is larger than the people you would have handed it to, and it does not shrink when someone leaves. GitHub scans a repository's entire history across all branches precisely because the old commits keep working.
Rotation is the real fix and the usual sticking point. Nobody is sure what breaks when the old value stops working, so the change waits. OWASP advises rotating regularly so stolen credentials stay useful only briefly, which is exactly the habit that never forms.
How it shows up
They surface in committed config files, in mobile bundles anyone can unpack, in front end code shipped to the browser, and in test fixtures quietly pointing at production. Search your history for password, api_key and secret, then set aside an uncomfortable half hour.
Found one? Assume somebody else has it. Rotate first and investigate afterwards, because the investigation takes days while the exposure stays live. Secrets are one of the ten classes we test, and each finding arrives with the request, the response and the source line.
Questions people ask
Hardcoded secret, answered
I deleted the line. Is the key safe now?
No. The commit that added it is still in the history, and anybody with a clone of the repository still has the value. Rewriting history helps a little and does not reach copies other people already pulled.
Treat deletion as tidying up. Rotating the credential is the part that actually ends the exposure.
It is a private repository. Does it still matter?
Yes. Private repositories get made public by accident, contractors keep clones, laptops get stolen and accounts get phished. The value also spreads into build logs and CI caches that have different permissions from the code.
The safer rule is simple: the only good place for a secret is outside the source tree.
Are environment variables good enough?
They are a large improvement over source code and not the end of the story. Environment variables leak into crash dumps, process listings, logs and error trackers, and they are easy to copy into a developer's shell and forget.
For anything valuable, a secrets manager that issues short-lived values beats a static string in the environment.
How quickly does a leaked key get used?
Fast enough that you should not plan around a grace period. People run automated scanners against public code looking for exactly this, and cloud credentials attract attention within minutes rather than days.
Assume the clock started when the commit landed, not when you noticed.
What do I do first when I find one?
Rotate the credential, then look at what it could reach and whether anything used it. Revoking first limits the damage while the investigation runs, and it is much easier than explaining a fortnight of quiet access.
After that, add scanning to the pipeline so the next one fails the build before it merges.
Sources
Where this comes from
Related
Terms that sit next to this one
Secrets management
Keeping keys, passwords and tokens out of code and in a vault.
Key rotation
Replacing a credential on a schedule so a leaked one has a short life.
Least privilege
Giving every person and service the minimum access the job requires.
Supply chain attack
Reaching you through a library, a build tool or a vendor you trust.
Audit log
A record of who did what and when, kept so you can answer later.
What is still in your history?
Exposed secrets are one of the ten classes we test, and every finding arrives with the request, the response and the source line behind it. Start with a $199 pilot on one application.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.