Hardcoded Secret
A hardcoded secret is a credential such as a password, API key, token, or private key written directly into source code or configuration and committed to a repository, where anyone with read access to the code — or its git history — can retrieve and abuse it.
A hardcoded secret is any sensitive value — an API key, database password, encryption key, OAuth token, or private certificate — embedded literally in source code, config files, container images, or CI pipelines instead of being supplied at runtime from a secure store. Because code is copied, shared, backed up, and pushed to version control, a secret in code is effectively a secret exposed to everyone who can reach that code, now or in the future.
The core danger is persistence and reach: even if a secret is later removed, it usually remains in git history, forks, and clones, so it must be treated as compromised and rotated. Leaked secrets are actively harvested from public repositories and are a leading cause of breaches, giving attackers direct, authenticated access to databases, cloud accounts, and third-party services. This weakness is cataloged as CWE-798 (use of hard-coded credentials).
Developers should keep secrets out of code entirely: load them from environment variables or a dedicated secrets manager, reference them via injected configuration, and add pre-commit and pipeline scanning to catch accidental commits. When a secret is detected, the correct response is to revoke and rotate it, not merely delete the line, because the exposed value can never be assumed private again.