No hardcoded API keys or secrets in source code

Hardcoded secrets in source code are the most common high-severity finding in AI-built projects: the model fills in a working API key to make the code run, and the developer ships it without noticing. A Stripe secret key (sk_live_) hardcoded in lib/stripe.ts gives anyone with repo read access the ability to create charges, refund transactions, or read customer data. A hardcoded JWT secret lets an attacker forge authentication tokens. OWASP A07 (Identification and Authentication Failures) and CWE-798 (Use of Hard-coded Credentials) directly describe this class of defect. PCI-DSS 4.0 Req 8.6.2 explicitly prohibits hard-coded credentials in any system component. Secrets in git history must be rotated even after removal from the code — the history is permanent.

Move every secret literal to an environment variable reference. The fix is mechanical — find the literal, move it to .env.local, and reference it via process.env.

// Before (DANGEROUS — rotate this key immediately):
const stripe = new Stripe('sk_live_abc123...')

// After (SAFE):
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!)

After moving secrets to environment variables: rotate every exposed key immediately — assume any secret that ever appeared in your git history has been seen, regardless of whether the repo was private. Use git log -S 'sk_live_' to confirm the secret is gone from all commits; if it isn't, you need a history rewrite (git filter-repo).