Hardcoded secret or API key
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 25 points from that category, once per scan, no matter how many places it turns up.
What it detects
Detects string patterns matching common cloud/API secret formats (AWS, Stripe, GitHub, Slack) or generic api_key/secret assignments.
Why it matters
A leaked API key in your code is usable by anyone who can read the repo, and public GitHub repos are scraped for exactly these patterns within minutes. Attackers use found keys to run up cloud bills, send spam through your accounts, or pull customer data. Removing the key from code is not enough on its own, the key also has to be rotated.
How to fix it
Move each secret into an environment variable and read it at runtime (process.env in Node, os.environ in Python). Keep real values in an untracked .env file locally and in your host secret store (Cloudflare, Vercel, AWS SSM) in production, with a .env.example listing the names only. Then rotate every exposed key with its provider, because git history still contains the old value. For history cleanup on shared repos use git filter-repo or BFG.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo