Learn how to prevent hardcoded secrets in your code with real examples and best practices. Protect your applications from exposing sensitive credentials and API keys.
What are Hardcoded Secrets and How Do They Impact Security?
Hardcoded secrets are sensitive credentials, API keys, or passwords that are directly embedded in source code. This is a significant security risk as it can expose sensitive information to unauthorized users, especially when code is shared or made public.
The risks of hardcoded secrets include:
Exposure of sensitive credentials in version control systems
Difficulty in rotating or changing credentials
Potential unauthorized access to systems and services
Compliance violations and security audit failures
This guide covers hardcoded secrets, examples, prevention methods, and how to properly manage sensitive credentials in your applications.
One Simple Hardcoded Secret Example
Consider this common example of hardcoded credentials:
This exposes the database credentials directly in the code, making them:
Visible to anyone with code access
The credentials should instead be stored in:
Environment variablesSecret management systemsConfiguration files (outside version control)
Hardcoded Secrets Prevention Methods: How to Fix Your Code
The most effective way to fix hardcoded secrets is to externalize them from the code using environment variables or secure secret management systems.
Environment variables and secret managers provide a secure way to store and access sensitive credentials while keeping them separate from the application code.
Code Samples
Vulnerable Code
public class ApiClient {
private static final String API_KEY = ;
private static final String API_SECRET = "secretKey123!";
public void makeApiCall() {
// Use API_KEY and API_SECRET
}
}
Fixed Code
public class ApiClient {
private static final String API_KEY = System.getenv("API_KEY");
private static final String API_SECRET = System.getenv("API_SECRET");
public void makeApiCall() {
if (API_KEY == null || API_SECRET == null) {
throw new IllegalStateException("API credentials not configured");
}
// Use API_KEY and API_SECRET
}
}
Fix Explanation
The vulnerable code contains hardcoded API credentials directly in the source code. The fix uses environment variables to retrieve sensitive credentials at runtime. Added null checks to ensure credentials are properly configured. Credentials can now be easily rotated without code changes.
The vulnerable code exposes API credentials directly in the source code. The fix uses dotenv to load environment variables. Credentials are accessed through process.env. Added validation to ensure required credentials are present.
from os import environ
from dotenv import load_dotenv
class DatabaseConnection:
def __init__(self):
load_dotenv()
self.username = environ.get('DB_USERNAME')
self.password = environ.get('DB_PASSWORD')
self.host = environ.get('DB_HOST')
def connect(self):
if not all([self.username, self.password, self.host]):
raise ValueError("Missing database credentials")
return mysql.connector.connect(
user=self.username,
password=self.password,
host=self.host
)
Fix Explanation
The vulnerable code contains hardcoded database credentials. The fix uses environment variables loaded through python-dotenv. Added validation to ensure all required credentials are available. Credentials can be managed separately from the code.
Vulnerable Code
public class PaymentService
{
private readonly string apiKey = "pk_test_51ABC123";
private readonly string apiSecret = "sk_test_98XYZ456";
public async Task ProcessPayment(decimal amount)
{
var client = new HttpClient();
client.DefaultRequestHeaders.Authorization =
new AuthenticationHeaderValue("Bearer", apiSecret);
// Process payment
}
}
Fixed Code
public class PaymentService
{
private readonly string apiKey;
private readonly string apiSecret;
public PaymentService(IConfiguration configuration)
{
apiKey = configuration["Payment:ApiKey"]
?? throw new ArgumentNullException("Payment:ApiKey");
apiSecret = configuration["Payment:ApiSecret"]
?? throw new ArgumentNullException("Payment:ApiSecret");
}
public async Task ProcessPayment(decimal amount)
{
var client = new HttpClient();
client.DefaultRequestHeaders.Authorization =
new AuthenticationHeaderValue("Bearer", apiSecret);
// Process payment
}
}
Fix Explanation
The vulnerable code contains hardcoded payment API credentials. The fix uses ASP.NET Core's configuration system. Credentials are injected through dependency injection. Added null checks to ensure credentials are configured.
class S3Client
{
private $accessKey;
private $secretKey;
public function __construct()
{
$this->accessKey = getenv('AWS_ACCESS_KEY_ID');
$this->secretKey = getenv('AWS_SECRET_ACCESS_KEY');
if (!$this->accessKey || !$this->secretKey) {
throw new RuntimeException('AWS credentials not configured');
}
}
public function uploadFile($file)
{
$s3 = new Aws\S3\S3Client([
'credentials' => [
'key' => $this->accessKey,
'secret' => $this->secretKey,
],
'region' => 'us-west-2',
'version' => 'latest'
]);
// Upload file
}
}
Fix Explanation
The vulnerable code contains hardcoded AWS credentials. The fix uses environment variables to store credentials. Added validation to ensure credentials are available. Follows AWS security best practices for credential management.
Vulnerable Code
class AuthService {
private:
const std::string API_KEY = "my-static-api-key-123";
const std::string API_SECRET = "my-static-secret-456";
public:
bool authenticate() {
// Use API_KEY and API_SECRET for authentication
return true;
}
};
Fixed Code
class AuthService {
private:
std::string API_KEY;
std::string API_SECRET;
public:
AuthService() {
char* apiKey = std::getenv("API_KEY");
char* apiSecret = std::getenv("API_SECRET");
if (!apiKey || !apiSecret) {
throw std::runtime_error("Missing API credentials");
}
API_KEY = std::string(apiKey);
API_SECRET = std::string(apiSecret);
}
bool authenticate() {
// Use API_KEY and API_SECRET for authentication
return true;
}
};
Fix Explanation
The vulnerable code contains hardcoded API credentials. The fix uses environment variables through std::getenv. Added validation to ensure credentials are available. Credentials can be managed externally from the application.
Need more help in preventing Hardcoded Secrets?
We'd love your feedback!
We're excited to hear your thoughts and ideas about fixing vulnerabilities.
