> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iriscode.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Hardcoded Secrets: Two-Layer Credential Detection in Iris Code

> Iris Code catches credentials in two ways: variables that look like secrets, and strings that are unmistakably keys.

A hardcoded credential is the one finding that cannot be deferred. Once it is pushed it remains in the history permanently, and the only complete fix is rotating it.

It carries the heaviest penalty in the scoring system at **10 points**, enough for a single key to take a file below your threshold on its own.

## Two ways of catching one

**By variable name.** A string assigned to something called `key`, `token`, `secret`, `password`, `auth`, `credential` or `api`, including common variants.

**By format.** Some values are recognisable regardless of the name they are given:

* GitHub tokens (`ghp_`)
* OpenAI and Stripe keys (`sk-`)
* AWS access key IDs (`AKIA`)
* Google API keys (`AIza`)
* Slack tokens (`xoxb-` / `xoxp-`)
* Inline Bearer tokens

Between them, both `const apiKey = "..."` and a raw token assigned to a variable called `x` are caught.

<Note>
  Placeholders are excluded automatically: `your_key_here`, `changeme`, `REPLACE_ME` and all-caps templates. Flagging the example in a README would train people to ignore the warnings. When both layers match the same line, you get one finding rather than two.
</Note>

## CLI scanning

`iris secrets` is free and needs no account:

```bash theme={null}
iris secrets
iris secrets ./src --format json
```

<Tip>
  `iris secrets` is worth adding to CI even if nobody on the team has Pro. It requires no licence and checks every push for leaked credentials.
</Tip>

## Configuration

```json theme={null}
{
  "enableSecretsDetection": false
}
```

If you want it still scored but without squiggles, leave that on and set `inlineDiagnostics.hardcodedSecrets` to `false` instead.

## If one has already been committed

Removing a key from a file does not remove it from your history. [Git History Secrets](/features/git-history-secrets) scans past commits for exactly this case.

Either way, rotate the credential. A secret that reached a remote should be treated as compromised.

<Note>
  [Security Smells](/features/security-smells) covers nine further patterns: eval usage, SQL string-building, weak hashing, disabled TLS and others. They run alongside secrets detection and count toward the same Blockers total.
</Note>