Hardcoded credentials (generic pattern)
CriticalAV-SECRET-001Secrets & data exposureCore pack
What it finds
A field named like a credential assigned a 16+ character inline string literal.
Why it matters
Hardcoded secrets are visible in version control history, logs, and error traces indefinitely.
How to fix it
Move to environment variables or a secret manager; never commit `.env` files.
Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans
Check details
- Finding code
- HARDCODED_CREDENTIALS
- How it detects
- Looks for a specific risky pattern in the code or config.
- Confidence
- Definite: the risky setting is written plainly in the file.
- Scans
- Any text-based source, config, or environment file
Check your agent for this
Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.
Related checks
- Credential or secret placed in the system promptAV-DATA-002 · High
- Data exfiltration path: private data + untrusted input + outbound channelAV-DATA-003 · High
- Credential stored in plain text in the MCP configAV-MCP-102 · High
- All environment variables handed to an MCP serverAV-MCP-111 · High
- Personal data sent to the model without redactionAV-DATA-004 · High
- Sensitive values written to logsAV-DATA-001 · Medium