Hardcoded secret
A hardcoded secret is an API key, password, or token written directly into a program's source code, rather than loaded from an environment variable or a secrets manager at runtime. Anyone who can read the source, including through version control history, can read the secret.
Why it matters
Hardcoding is often the fastest way to get something working, which is exactly why it is common in scripts and prototypes, and exactly why it needs to be cleaned up before that code is shared or committed anywhere.
Is hardcoding a secret ever acceptable?
Only in something that will never be shared, committed, or run outside a fully trusted, temporary context, and even then it is a habit worth avoiding.
How do I find hardcoded secrets in an existing project?
Secret scanning tools search a codebase and its git history for patterns that look like keys or tokens.
Related
Looking for a different way to manage your keys? See the best Claude Code API key manager alternatives, or browse every term in the glossary.