Skip to main content
A hardcoded credential is the one finding that cannot be deferred. Once it is pushed it remains in the history permanently, and the only complete fix is rotating it. It carries the heaviest penalty in the scoring system at 10 points, enough for a single key to take a file below your threshold on its own.

​
Two ways of catching one

By variable name. A string assigned to something called key, token, secret, password, auth, credential or api, including common variants. By format. Some values are recognisable regardless of the name they are given:
  • GitHub tokens (ghp_)
  • OpenAI and Stripe keys (sk-)
  • AWS access key IDs (AKIA)
  • Google API keys (AIza)
  • Slack tokens (xoxb- / xoxp-)
  • Inline Bearer tokens
Between them, both const apiKey = "..." and a raw token assigned to a variable called x are caught.
Placeholders are excluded automatically: your_key_here, changeme, REPLACE_ME and all-caps templates. Flagging the example in a README would train people to ignore the warnings. When both layers match the same line, you get one finding rather than two.

​
CLI scanning

iris secrets is free and needs no account:
iris secrets is worth adding to CI even if nobody on the team has Pro. It requires no licence and checks every push for leaked credentials.

​
Configuration

If you want it still scored but without squiggles, leave that on and set inlineDiagnostics.hardcodedSecrets to false instead.

​
If one has already been committed

Removing a key from a file does not remove it from your history. Git History Secrets scans past commits for exactly this case. Either way, rotate the credential. A secret that reached a remote should be treated as compromised.
Security Smells covers nine further patterns: eval usage, SQL string-building, weak hashing, disabled TLS and others. They run alongside secrets detection and count toward the same Blockers total.