Hardcoded Secrets in Code: How to Find Them and Get Them Out (video)

Hardcoded passwords, API keys, and tokens are one of the most common causes of leaked credentials. Learn how to find hardcoded secrets in source code, rotate them safely, and stop new ones reaching GitHub.

Read the full article

Transcript

Hardcoded Secrets in Code: How to Find Them and Get Them Out. Here's the short version.

A hardcoded secret is any credential written directly into source code: a database password in a config class, an API key in a JavaScript file, a token pasted into a test.

What counts as a hardcoded secret?. Database connection strings with embedded username and password. Cloud provider access keys and service-account JSON files. Third-party API keys (payments, email, SMS, maps, AI providers). OAuth client secrets and long-lived personal access tokens.

Here's an example: Java — password in a constant.

Why deleting the line is not enough. Git keeps history. That is why the first response to a leaked secret is always rotation.

Before: secrets living in source. These patterns appear in every language. They usually start as “just for local testing” and survive into production.

Want to find these issues in your own code? Connect your GitHub repository to CodeInspector. You'll get findings with the file, line, severity, and a recommended fix, plus HTML and PDF reports for your team. Start free at codeinspector.app.

More videos

All videos