Hardcoded Secrets Detection — ShipSafe
How ShipSafe detects hardcoded API keys, tokens, and passwords in your code.
174 detection rulesLocal-only scanning
What is Hardcoded Secrets?
Hardcoded secrets are API keys, tokens, passwords, and credentials committed directly in source code. Once pushed to a repository, secrets are permanently in git history and can be found by attackers. GitHub reports that over 10 million secrets are leaked in public repositories every year.
What ShipSafe Detects
- ✓AWS access keys and secret keys
- ✓Stripe API keys (live and test)
- ✓GitHub personal access tokens and OAuth tokens
- ✓Google Cloud service account keys
- ✓Azure storage keys and connection strings
- ✓Slack tokens and webhook URLs
- ✓Twilio, SendGrid, Firebase, and Supabase keys
- ✓Database connection strings with embedded passwords
- ✓Private keys (RSA, DSA, EC, PGP)
- ✓Generic high-entropy strings that match credential patterns
Example: Vulnerable Code
Hardcoded Stripe key and database password
// Vulnerable: hardcoded API key
const stripe = require("stripe")(
"sk_live_4eC39HqLyjWDarjtT1zdp7dc"
);
// Vulnerable: hardcoded database password
const db = new Pool({
host: "db.example.com",
user: "admin",
password: "SuperSecret123!",
database: "production",
});ShipSafe Catches It
$ shipsafe scan CRITICAL secrets/stripe-live-key src/payments.ts:2 Stripe live secret key detected. This key has full access to your Stripe account. Fix: Move to environment variable — process.env.STRIPE_SECRET_KEY HIGH secrets/database-password src/db.ts:5 Database password hardcoded in source code. Fix: Move to environment variable — process.env.DATABASE_PASSWORD
Detect Hardcoded Secrets in Your Code
Install ShipSafe and scan your project in under 60 seconds.
npm install -g @shipsafe/cli