Hard-Coded Secrets

Hard-coded secrets — passwords, API keys, cryptographic keys, and tokens embedded directly in source code — are one of the most consistently exploitable defect classes.

When code is shared, versioned, or decompiled, hard-coded secrets are exposed. Attackers actively scan public repositories for them.

Solutions such as secrets managers, vaults, and workload identity remove this class. Some have existed for decades.

Discussion prompts

• Does your team scan for hard-coded secrets in code commits? What happens when one is found?
• Have you ever had a hard-coded secret exposed? What was the impact — and what changed afterward?
• What would a secrets management policy look like that made hard-coded secrets structurally impossible to ship?