Why this matters
Hardcoded secrets are a common breach vector and often get copied into logs, client bundles, or forks.
Never hardcode credentials (API keys, tokens, private keys) in source code, configs, or tests. If a string looks like a credential based on context (variable name, header usage, auth flows), treat it as a secret even if it is not high-entropy. Move it to env/secret manager, rotate the credential if it may have leaked, and remove it from git history if necessary.
Hardcoded secrets are a common breach vector and often get copied into logs, client bundles, or forks.
Side-by-side examples engineers can pattern-match during review.
const STRIPE_SECRET_KEY = "sk_live_..."; // committedconst stripeKey = process.env.STRIPE_SECRET_KEY; assert(stripeKey); // injected via secrets managerAuthorization: Bearer <hardcoded token>Read from env/secret manager; no secret literal in repoFrom the same buckets as this rule.