Will It Vibe?Hardcoded encryption key
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 15 points from that category, once per scan, no matter how many places it turns up.
What it detects
A symmetric key is a literal in source (cipher argument, SecretKeySpec, or a *_key assignment). Anyone with the code can decrypt the data.
Why it matters
A hardcoded encryption key means anyone who can read the source (contractors, anyone who clones a fork, scrapers of public repos) can decrypt everything the key protects. The key also stays in git history after you edit it out. There is no way to rotate a key that is baked into shipped code without a release.
How to fix it
Load the key at runtime from an environment variable or a secret manager (Cloudflare/Vercel secrets, AWS KMS/Secrets Manager, Vault). Keep the real value out of the repo and out of history, put a placeholder name in .env.example, and rotate the exposed key. Re-encrypt data if the old key was ever used in production.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo