Hardcoded Secrets in Vibe Coded Apps

What are hardcoded secrets?

Hardcoded secrets are sensitive credentials (API keys, passwords, tokens) written directly into source code instead of environment variables or secret managers. Common examples include Stripe/OpenAI/AWS API keys, database connection strings, JWT signing secrets, and OAuth client secrets.

Once committed to version control, secrets persist in git history forever, even after you "delete" them. Automated bots continuously scan public repositories and can exploit exposed secrets within minutes. According to GitGuardian's 2024 State of Secrets Sprawl Report, over 12 million new secrets were detected in public GitHub commits in 2023.

According to OWASP, identification and authentication failures (which includes exposed credentials) ranked #7 in the Top 10 Web Application Security Risks. The CWE Top 25 also lists hardcoded credentials as a dangerous weakness. For vibe coders, this is the most common security mistake.

How do AI tools cause hardcoded secrets?

AI tools cause hardcoded secrets by generating complete, working examples with placeholder credentials that developers forget to replace. When you ask for "Stripe integration," the AI produces functional code with inline API keys because that's what works immediately.

// AI generates this "working" example
const stripe = new Stripe('sk_live_EXAMPLE_KEY_HERE', {
  apiVersion: '2023-10-16'
})

// Or database connections with inline credentials
const db = new Pool({
  connectionString: 'postgresql://user:password123@localhost:5432/mydb'
})

// Or JWT secrets directly in code
const JWT_SECRET = 'super-secret-key-change-me'

Why this happens: AI models are trained on code examples that often include placeholder credentials for demonstration. The AI doesn't distinguish between "example code" and "production code". It generates what works.

All major AI coding tools (Cursor, Claude Code, Bolt, v0, and Copilot) can generate these patterns. Whether you're vibe coding with Bolt (which is particularly prone due to its "ready to run" philosophy) or any other AI tool, always check for hardcoded credentials before committing.

What could happen if I have hardcoded secrets?

Hardcoded secrets can result in financial damage, data breaches, service abuse, and account takeover within minutes of exposure.

• Financial damage: Attackers use your AWS/GCP/Azure credentials to spin up crypto miners, running up thousands in charges
• Data breach: Database credentials expose all user data: emails, passwords, payment info, personal details
• Service abuse: Your OpenAI/Stripe/Twilio API keys get used until rate limits hit or accounts are suspended
• Account takeover: OAuth and JWT secrets let attackers forge authentication tokens and impersonate any user
• Lateral movement: One exposed credential often leads to others. Database access reveals more secrets stored in tables

How do I detect hardcoded secrets?

Detect hardcoded secrets by searching for API key prefixes (sk_live_, AKIA, ghp_), database connection strings, and variable names like API_KEY, SECRET, or PASSWORD with inline values.

# API key patterns
sk_live_    # Stripe live keys
sk_test_    # Stripe test keys (still sensitive!)
AKIA        # AWS access key IDs
ghp_        # GitHub personal access tokens
xoxb-       # Slack bot tokens

# Database connection strings
postgresql://
mongodb+srv://
mysql://

# Common variable names with inline values
const API_KEY = '...'
const SECRET = '...'
const PASSWORD = '...'
const TOKEN = '....'

# Regex for generic secrets
['"](sk|pk|api|key|secret|password|token)[_-]?['"]*[:=]['"]w{20,}['"]

Use automated tools: TruffleHog, GitLeaks, and GitGuardian scan your entire git history for exposed secrets.

How do I fix hardcoded secrets?

Fix hardcoded secrets by moving all credentials to environment variables and adding .env to your .gitignore before committing.

// Hardcoded API key - DANGEROUS
const openai = new OpenAI({
  apiKey: 'sk-abc123def456...'
})

// Database password in code - DANGEROUS
const pool = new Pool({
  connectionString: 'postgresql://admin:[email protected]/prod'
})

// Load from environment variable - SAFE
const openai = new OpenAI({
  apiKey: process.env.OPENAI_API_KEY
})

// Connection string from env - SAFE
const pool = new Pool({
  connectionString: process.env.DATABASE_URL
})

// Add to .env (never commit this file!)
// OPENAI_API_KEY=sk-abc123def456...
// DATABASE_URL=postgresql://admin:[email protected]/prod

Frequently asked questions

Related content