hardcoded-secrets

Flag hardcoded API keys, passwords, tokens, and private keys in source code and configuration files.

20|Updated Feb 27, 2026

Search Tags:#environment-variables #secrets-management #hardcoded-secrets #secure-coding #credential-security #cwe-798

Ready to run

npx skills add https://github.com/thejefflarson/soundcheck --skill hardcoded-secrets

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hardcoded-secrets
Source: https://github.com/thejefflarson/soundcheck/tree/main/.claude/skills/hardcoded-secrets
Command: npx skills add https://github.com/thejefflarson/soundcheck --skill hardcoded-secrets

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Use when writing code that contains API keys, passwords, tokens, connection strings, or private keys as string literals. Also invoke when embedding credentials in configuration files, environment setup scripts, or test fixtures that could be committed to version control.

Core Features & Use Cases

Flag hardcoded secrets in source code and configuration.
Recommend loading secrets from external sources (env vars, secrets managers, or OS keystores).
Provide guidance on secure coding practices and immediate remediation steps across CI/CD.

Quick Start

Review your codebase to identify any hardcoded credentials and replace them with environment-based loading and secrets management.

Frequently Asked Questions about hardcoded-secrets

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I find hardcoded secrets and API keys in my source code?▼

To find hardcoded secrets, scan string literals in source code and configuration files for exposed API keys, passwords, tokens, and private keys. This flags credentials committed to version control, enabling replacement with environment variables or external secret managers.

What is the best way to manage credentials in configuration files?▼

The best way to manage credentials in configuration files is loading secrets from external sources like environment variables, secret managers, or OS keystores. This prevents hardcoded credentials from leaking and enforces secure coding practices across CI/CD pipelines.

How do I prevent passwords from being committed to version control?▼

Prevent passwords from being committed to version control by replacing string literals with environment-based loading and external secrets management. Validate that test fixtures use fake values instead of real credentials to ensure no actual secrets are exposed.

Does hardcoded secrets detection work with environment setup scripts and test fixtures?▼

Hardcoded secrets detection works with environment setup scripts and test fixtures to identify embedded credentials. It flags exposed API keys and tokens in these files, recommending fake values for tests and external secret managers for live configuration.

Why should I use environment variables instead of private keys in code?▼

Use environment variables instead of private keys in code to prevent credential leakage through version control. Loading secrets from external sources like OS keystores or secret managers enforces secure coding practices and protects sensitive connection strings from exposure.

Clear-Capabilities