No hardcoded secrets in source code

Hardcoded secrets in source code violate CWE-798 (Use of Hard-coded Credentials) and OWASP A07 (Identification & Authentication Failures), and they are permanent: unlike a leaked .env file, a credential baked into a function call survives every deployment, every refactor, and every repo clone. A Stripe live key or database password embedded in a TypeScript file is readable by every developer, CI runner, contractor, and open-source contributor who touches the repo. NIST IA-5 requires credential management controls — hardcoded values have no rotation path, no access control, and no audit trail.

Move every secret out of source files and into environment variables. Validate presence at startup so missing config fails fast rather than failing silently mid-request.

// src/config/secrets.ts
// BEFORE (wrong)
export const STRIPE_KEY = 'sk_live_51234...'

// AFTER (correct)
export const STRIPE_KEY = process.env.STRIPE_SECRET_KEY
if (!STRIPE_KEY) throw new Error('STRIPE_SECRET_KEY not set')

For each secret removed from source code, generate a new credential in the service dashboard (the old one is compromised), store it in your secrets manager or CI environment, and delete it from git history with git filter-repo.