Hardcoded Secrets

The fastest way to give away the keys to the kingdom.

The idea

A "secret" is any sensitive string needed to run your app: database passwords, API keys, encryption salts, or AWS credentials. Hardcoding a secret means typing it directly into your source code. If that code is ever committed to a Version Control System (like Git), the secret is compromised forever.

How it works (Environment Variables)

Secrets should never live in code. They should be injected into the application at runtime by the environment (using `.env` files locally, and secure Secret Managers like AWS Secrets Manager or HashiCorp Vault in production).

# VULNERABLE: Hardcoded
def init_payment_gateway():
    # Anyone who can view this file on GitHub now controls your Stripe account.
    stripe.api_key = "sk_live_51Habcdefghijklmnopqrstuvwxyz123"

# SECURE: Environment Variables
import os

def init_payment_gateway():
    # The code is safe to share. The secret is injected at runtime.
    stripe.api_key = os.environ.get("STRIPE_API_KEY")

Watch out for

• Git History: If you accidentally commit a secret and then remove it in the next commit, the secret is still permanently accessible in the Git history. You must completely rewrite history or immediately revoke/rotate the secret (the safer option).
• Client-Side Exposure: Using environment variables in frontend code (like React or Vue) usually bundles those secrets directly into the downloaded JavaScript file, making them visible to anyone who inspects the network tab.
• Leaky Logs: Even if you use environment variables, you might accidentally log the secret to a logging platform (like Datadog) where thousands of employees can view it.

Worked example

A developer is building a mobile app. They need to connect to Firebase, so they hardcode the `FIREBASE_API_KEY` into the Android Java code. They compile the app and publish it to the Google Play Store. A hacker downloads the app, decompiles the APK (which takes 5 seconds), extracts the API key, and deletes the entire production database.

Check yourself

You accidentally pushed a commit containing your AWS Secret Key to a public GitHub repository. You immediately deleted the line of code and pushed a new commit 30 seconds later. Are you safe?