Hardcoded Secrets in Code.

Embedding credentials, API keys, tokens, or cryptographic material directly in source code, configuration files, or container images, where they are easily discovered and abused. It belongs to the Application Security category of cybersecurity.

Embedding credentials, API keys, tokens, or cryptographic material directly in source code, configuration files, or container images, where they are easily discovered and abused.

Hardcoded secrets are one of the most common and damaging mistakes in modern development. They end up in Git history, container layers, mobile apps, CI logs, and public repositories, where bots scan them within minutes. Real-world exposures include AWS keys committed to GitHub, Slack tokens in client-side bundles, and database passwords baked into Docker images. Mitigations combine prevention (developer education, pre-commit hooks, IDE plugins, .gitignore patterns), detection (secret scanning in repos and CI such as GitHub secret scanning, Gitleaks, TruffleHog), and centralised secret management (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager, Kubernetes External Secrets). When detected, secrets must be rotated immediately, not just deleted from history.

Defences for Hardcoded Secrets in Code typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Hardcoded credentials, Secret leakage in code.