Hardcoded secrets are credentials written directly into source code, configuration files, scripts or container images. Examples include passwords, API keys, access tokens, database connection strings and private keys. MITRE’s weakness catalog lists the use of hard-coded credentials as CWE-798.

How it works

• A developer adds a key to code for a quick test, and it is committed to version control.
• The secret stays in the repository history even after it is deleted from the latest version.
• Code is pushed to a public repository, shared with a supplier or leaked, and the secret goes with it.
• Attackers scan public code for key patterns and quickly test anything they find.

MITRE ATT&CK lists searching files and source code for stored credentials as technique T1552.001.

Why it matters for defenders

A single leaked cloud key can give access to data, systems and computing resources, and can lead to cryptojacking or a supply chain attack. The OWASP Secrets Management Cheat Sheet recommends keeping secrets in a dedicated vault, scanning code before commits and rotating any secret that has been exposed. Deleting the line is not enough: an exposed secret must be revoked. Services that watch for secrets in public code help find leaks in repositories the organization does not control.

Sources: CWE-798: Use of Hard-coded Credentials, OWASP Cheat Sheet Series: Secrets Management