"Secrets Management: Stop Hardcoding API Keys"

In 2024, a major SaaS company leaked 10,000 API keys in a public GitHub repository. The keys were hardcoded in config files that a developer committed "just for testing." The breach cost millions.

This happens constantly. And AI coding assistants are making it worse — they generate code with placeholder credentials that look real enough to ship.

The Hardcoded Secrets Problem

When you ask an AI to "build an app with Stripe integration," it generates:

STRIPE_KEY = "sk_live_abc123xyz789"

That's a placeholder — but it looks like a real key. If a developer commits this to a public repo, attackers scan for these patterns and steal the keys. Within minutes, they can make charges on your Stripe account.

GitHub detects this automatically. They scan every public repository for known secret patterns. If you commit a key, you'll get an alert within seconds. But many keys slip through — custom formats, encoded secrets, split tokens.

The 5 Types of Secrets That Get Leaked

1. API Keys

# Common AI-generated pattern
API_KEY = "sk-proj-abc123xyz789"
STRIPE_SECRET = "sk_live_abc123"

2. Database Credentials

# Common AI-generated pattern
DATABASE_URL = "postgresql://user:password@localhost:5432/db"

3. JWT Secrets

# Common AI-generated pattern
SECRET_KEY = "super-secret-key-do-not-share"

4. OAuth Tokens

# Common AI-generated pattern
GITHUB_TOKEN = "ghp_abc123xyz789"
SLACK_TOKEN = "xoxb-abc123xyz789"

5. Encryption Keys

# Common AI-generated pattern
ENCRYPTION_KEY = "a1b2c3d4e5f6..."

How to Detect Hardcoded Secrets

Method 1: detect-secrets (Free)

pip install detect-secrets
detect-secrets scan

This scans your codebase for known secret patterns and outputs a baseline file.

Method 2: GitLeaks (Free)

# Install
brew install gitleaks  # macOS
# or
docker run --rm -v $(pwd):/path zricethezav/gitleaks detect -s /path

# Scan entire repo history
gitleaks detect --source . --verbose

Method 3: GitHub Secret Scanning

GitHub automatically scans public repos for known secret patterns. Enable it in your repo settings under "Security" → "Code security and analysis."

How to Manage Secrets Properly

Step 1: Never Hardcode Secrets

# WRONG
API_KEY = "sk-abc123"

# RIGHT
API_KEY = os.environ.get("API_KEY")
if not API_KEY:
    raise ValueError("API_KEY environment variable not set")

Step 2: Use Environment Variables

# .env file (NEVER commit this)
API_KEY=sk-abc123
DATABASE_URL=postgresql://user:pass@localhost/db

# .gitignore (ALWAYS commit this)
.env
.env.local
.env.production

Step 3: Use a Secrets Manager

For production:

Step 4: Rotate Compromised Secrets

If a secret is leaked:

1. Revoke immediately — disable the compromised key

2. Generate a new one — create a replacement

3. Update all references — change it in every config file, CI/CD, and deployment

4. Scan for other leaks — check if other secrets were exposed in the same commit

5. Review access logs — check if the leaked key was used

Step 5: Scan Before Every Commit

Add secrets scanning to your pre-commit hook:

# Install pre-commit
pip install pre-commit

# Add to .pre-commit-config.yaml
repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.18.0
    hooks:
      - id: gitleaks

The AI-Specific Problem

AI coding assistants make secrets management harder because:

1. They generate realistic-looking placeholders — sk-proj-abc123 looks like a real Stripe key

2. They use common patterns — developers copy-paste without checking

3. They don't warn about secrets — the AI doesn't know if a value is a real secret or a placeholder

4. Training data includes leaked secrets — AI models have seen real API keys in public repos

Best Practices for AI-Generated Code

1. Always check for hardcoded secrets after AI generates code

2. Replace placeholders with environment variables before committing

3. Add detect-secrets to your pre-commit hooks

4. Never commit .env files — add them to .gitignore

5. Use GitHub Secrets for CI/CD — never hardcode in workflow files

How VulnLedger Helps

VulnLedger focuses on dependency security, but secrets management is the other half of the puzzle. Together:

- VulnLedger scans your dependencies for CVEs

- detect-secrets scans your code for hardcoded secrets

- CI/CD gate prevents both from reaching production

# Scan dependencies
pip install vulnledger
vulnledger scan . --ci

# Scan for secrets
pip install detect-secrets
detect-secrets scan

Conclusion

Hardcoded secrets are the #1 cause of data breaches, and AI coding assistants make it worse. The fix is straightforward: never hardcode secrets, use environment variables, scan before committing, and add automated checks to your CI/CD pipeline.

Next in this series: CI/CD Security: Catch Vulnerabilities Before They Reach Production

Previous: Dependency Security: How to Scan and Fix Vulnerable Packages

See also: From Vibe Code to Production: 7 Things AI Won't Do For You