Hardcoded API Key or Password

Why it matters

Source code travels: into git history, CI logs, container images and every developer's laptop. Once a key is in it, it is effectively public and has to be rotated. Reading it from the environment keeps the code shareable and lets you change the key without a deploy.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

API_KEY = "sk-proj-abcdefghijklmnopqrstuvwxyz1234567890"

The smallest fix

import os
API_KEY = os.environ["OPENAI_API_KEY"]   # raises early if missing
# or, with a default for local development:
DB_PASSWORD = os.getenv("DB_PASSWORD", "")

The better fix

If you have a few more minutes, this is the approach that holds up as the app grows.

# Load a .env file in development with python-dotenv and keep .env out
# of git. In production, set the variable on the host or use a secrets
# manager. Rotate the key that was committed: it is already exposed.

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

How to check the fix worked

1. Run `git log -p | grep <key-prefix>` to see whether it is in history.
2. Start the app without the variable set and confirm it fails clearly.
3. Rotate the key in the provider's dashboard.

Further reading

• https://cwe.mitre.org/data/definitions/798.html