How to Detect and Fix Hardcoded API Keys in Your Codebase

Why Keys End Up in Code

Developers do not intentionally commit API keys. It happens because of:

• •Quick prototyping — you paste a key to test something and forget to move it to .env
• •AI code generation — tools like Cursor and Claude Code sometimes hardcode keys from context
• •Copy-paste from docs — many API docs use real-looking keys in examples
• •Config files — database connection strings with passwords, .env files committed by mistake
• •Test files — real credentials used in integration tests instead of mocks

What Attackers Do with Leaked Keys

Leaked keys are exploited within minutes. Automated bots scan every public git push for credential patterns. The consequences are immediate and severe:

• •AWS keys — crypto miners spin up thousands of EC2 instances, costing tens of thousands of dollars
• •Stripe keys — attackers issue refunds, create fraudulent charges, or steal customer data
• •Database passwords — data exfiltration, ransomware, complete system compromise
• •GitHub tokens — source code theft, supply chain attacks, backdoor injection

ShipSafe’s 174 Secret Detection Patterns

ShipSafe ships with 174 secret detection patterns that cover 50+ services. Each pattern is tuned for high accuracy with entropy-based filtering to minimize false positives.

Services Covered

Plus: private keys (RSA, DSA, EC, PGP), database connection strings, generic high-entropy tokens, and JWT secrets.

Finding Keys in Your Codebase

Scan your project with one command:

npm install -g @shipsafe/cli
shipsafe scan

ShipSafe shows exactly where each secret is:

$ shipsafe scan

  CRITICAL  secrets/aws-secret-key
  src/config/aws.ts:3
  AWS secret access key detected.
  Fix: Move to environment variable — process.env.AWS_SECRET_ACCESS_KEY

  CRITICAL  secrets/stripe-live-key
  src/payments/stripe.ts:1
  Stripe live secret key detected (sk_live_*).
  Fix: Move to environment variable — process.env.STRIPE_SECRET_KEY

  HIGH  secrets/database-password
  src/db/connection.ts:5
  Database password hardcoded in source code.
  Fix: Move to environment variable — process.env.DATABASE_URL

  MEDIUM  secrets/generic-api-key
  src/utils/analytics.ts:8
  High-entropy string assigned to variable "apiKey".
  Fix: Move to environment variable.

4 findings (2 critical, 1 high, 1 medium)

Fixing Leaked Keys

For each detected secret, follow this process:

1. Rotate the key immediately. Generate a new key from the service provider. The old key should be considered compromised.
2. Move to environment variables. Create a .env file (and add it to .gitignore) with the new key.
3. Update references. Replace hardcoded values with process.env.KEY_NAME.
4. Create .env.example. Document required environment variables without actual values.
5. Audit git history. If the key was ever committed, it is in git history forever. Rotating is the only safe remediation.

ShipSafe Pro can auto-fix detected secrets. The shipsafe_fix MCP tool moves secrets to .env and updates all references automatically.

Preventing Future Leaks with Git Hooks

The best defense is prevention. ShipSafe’s pre-commit hooks block secrets before they reach your repository:

shipsafe hooks install

Now every commit is scanned. If you accidentally add a file containing an API key:

$ git commit -m "Add payment integration"

  CRITICAL  secrets/stripe-live-key
  src/payments.ts:3
  Stripe live secret key detected.

  Commit blocked. Fix the findings above and try again.

This is especially valuable when using AI coding assistants like Claude Code and Cursor in autonomous mode.

ShipSafe vs Other Secret Scanners

Other tools detect secrets too. Here is how ShipSafe compares:

• •vs GitHub Secret Scanning — GitHub only scans after push. ShipSafe blocks before commit, so secrets never reach the remote.
• •vs Gitleaks — ShipSafe uses Gitleaks patterns under the hood, plus adds 40+ additional patterns and entropy-based filtering.
• •vs Snyk — Snyk focuses on dependency vulnerabilities, not secrets. ShipSafe has 174 dedicated secret patterns.
• •vs Semgrep — Semgrep Secrets is a paid add-on. ShipSafe includes all 174 patterns in the free tier.