Will It Vibe?Hardcoded Authorization bearer/basic token in config
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 8 points from that category, once per scan, no matter how many places it turns up.
What it detects
An Authorization header value with a literal Bearer/Basic token is stored in config. That token is a live credential for an upstream API, usable by anyone who reads the file until it is rotated.
Why it matters
An Authorization header with a literal Bearer or Basic token in config stores a live credential for an upstream API. Anyone who reads the file can call that API as your service until the token is rotated, and the value persists in git history. Tokens hardcoded this way are easy to miss because they look like ordinary config.
How to fix it
Read the token from an environment variable and build the Authorization header at runtime, keeping the real value in your host secret store with a placeholder in .env.example. Rotate the exposed token with the upstream provider. Prefer short-lived or scoped tokens where the API supports them.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo