Will It Vibe?Hardcoded AWS access key ID
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 25 points from that category, once per scan, no matter how many places it turns up.
What it detects
A literal AWS access key ID (AKIA...) in Terraform is a live credential in version control. Public repositories are scraped for exactly this pattern within minutes.
Why it matters
A literal AWS access key ID (AKIA...) in Terraform is a live long-term credential sitting in version control. Public repositories are scanned for this exact pattern within minutes of a push, and a matching secret key nearby gives an attacker direct API access to the account. Committed keys are a leading cause of cloud account compromise.
How to fix it
Remove the hardcoded key and let the AWS provider use the default credential chain (environment variables, shared credentials file, or an instance or OIDC role), which needs no keys in code. Deactivate and delete the exposed key pair in IAM immediately, since removing it from code does not revoke it. Prefer short-lived role-based credentials over static keys going forward.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo