Hardcoded Secrets Detection — ShipSafe

What is Hardcoded Secrets?

Hardcoded secrets are API keys, tokens, passwords, and credentials committed directly in source code. Once pushed to a repository, secrets are permanently in git history and can be found by attackers. GitHub reports that over 10 million secrets are leaked in public repositories every year.

Why It Matters

A leaked secret cannot be unleaked. Even if you delete the file in a new commit, the secret remains in git history forever (unless you force-push a rewritten history, which is disruptive and often incomplete). Automated bots scan every public GitHub push for credential patterns — AWS keys are exploited within minutes of exposure, typically to spin up cryptocurrency miners that can cost tens of thousands of dollars. Stripe keys can be used for fraudulent charges. Database passwords give direct access to user data. The only remediation is immediate key rotation.

What ShipSafe Detects

• ✓AWS access keys (AKIA prefix) and secret keys (40-char base64)
• ✓Stripe API keys — both live (sk_live_) and test (sk_test_) keys
• ✓GitHub personal access tokens (ghp_), fine-grained tokens (github_pat_), and OAuth tokens
• ✓Google Cloud service account keys (JSON private key format)
• ✓Azure storage keys, connection strings, and SAS tokens
• ✓Slack tokens (xoxb-, xoxp-, xoxs-) and webhook URLs
• ✓Twilio Account SID + Auth Token, SendGrid API keys, Firebase server keys, and Supabase service_role keys
• ✓Database connection strings with embedded passwords (postgresql://, mongodb+srv://, mysql://)
• ✓Private keys (RSA, DSA, EC, PGP) detected by BEGIN/END markers
• ✓Generic high-entropy strings assigned to variables named apiKey, secret, token, password, or credential

Example: Vulnerable Code

Hardcoded Stripe key and database password

// Vulnerable: hardcoded API key
const stripe = require("stripe")(
  "sk_live_4eC39HqLyjWDarjtT1zdp7dc"
);

// Vulnerable: hardcoded database password
const db = new Pool({
  host: "db.example.com",
  user: "admin",
  password: "SuperSecret123!",
  database: "production",
});

ShipSafe Catches It

$ shipsafe scan

  CRITICAL  secrets/stripe-live-key
  src/payments.ts:2
  Stripe live secret key detected. This key has full access to your Stripe account.
  Fix: Move to environment variable — process.env.STRIPE_SECRET_KEY

  HIGH  secrets/database-password
  src/db.ts:5
  Database password hardcoded in source code.
  Fix: Move to environment variable — process.env.DATABASE_PASSWORD

What to Do Instead

Safe alternative: environment variables with startup validation

// SAFE: load secrets from environment variables
const stripe = require("stripe")(process.env.STRIPE_SECRET_KEY);

const db = new Pool({
  connectionString: process.env.DATABASE_URL,
});

// .env (add to .gitignore — never commit this file)
// STRIPE_SECRET_KEY=sk_live_4eC39HqLyjWDarjtT1zdp7dc
// DATABASE_URL=postgresql://admin:SuperSecret123!@db.example.com/production

// .env.example (commit this — documents required vars without values)
// STRIPE_SECRET_KEY=
// DATABASE_URL=

// Validate env vars at startup so you catch missing config immediately
function requireEnv(name: string): string {
  const value = process.env[name];
  if (!value) throw new Error(`Missing required env var: ${name}`);
  return value;
}

const stripeKey = requireEnv("STRIPE_SECRET_KEY");
const databaseUrl = requireEnv("DATABASE_URL");

Frequently Asked Questions

Related Security Categories