Will It Vibe?@Value injects a hardcoded secret as its default
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 15 points from that category, once per scan, no matter how many places it turns up.
What it detects
@Value("${property.name:default}") names a property that looks like a secret (password/token/api key/credential) and supplies a non-trivial literal as the fallback used whenever that property is not set. Anyone with the source has a working credential the moment the real property is absent, which is easy to miss since the app still starts and appears to work.
Why it matters
A @Value default of the form "${property.name:actual-secret}" means anyone with the source has a working credential the moment that property is not set in the environment, which is easy to miss since the application still starts and appears to work normally with the fallback silently in effect.
How to fix it
Remove the literal default so the application fails to start when the property is missing (a fast, visible failure is far better than a silent, real credential in every environment), or point the default at a placeholder that is obviously not a working credential. Keep the actual value only in environment variables, a secret manager, or an untracked local config file.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo