Secret Leak

Critical

Detects hardcoded secrets, API keys, passwords, and tokens in code.

What It Checks

  • Hardcoded API keys and tokens
  • Passwords in source code
  • Private keys and certificates
  • OAuth client secrets

Vulnerability Example

// Vulnerable const API_KEY = 'sk-1234567890abcdef'; // Safe const API_KEY = process.env.API_KEY;

Severity

Critical - Can lead to account takeover, data breach, or unauthorized access.

Remediation

  1. Never commit secrets to version control
  2. Use environment variables
  3. Use a secrets management solution (HashiCorp Vault, AWS Secrets Manager)
  4. Rotate compromised credentials immediately