Secrets stored in environment variables and never committed to code
Why it matters
Hardcoded secrets in source files — JWT signing keys, Stripe secret keys, database passwords — are exposed to every developer with repository access, every CI system, every leaked ZIP or public GitHub push. CWE-798 (Hard-coded Credentials) and CWE-312 (Cleartext Storage of Sensitive Information) describe this as a critical class of vulnerability. OWASP A02 (Cryptographic Failures) and NIST 800-53 SC-28 require secrets at rest to be protected. Once a secret is in git history it is effectively public, even after deletion; the only remediation is rotation. A committed Stripe live key can drain accounts within minutes of a repo becoming public.
Severity rationale
Critical because committed secrets give anyone with repository read access full control over production services, and git history preservation means the window for damage extends indefinitely.
Remediation
Move all secrets to environment variables and add .env patterns to .gitignore immediately. If any secret has been committed, rotate it before removing it from history:
git rm --cached .env
echo '.env\n.env.*\n!.env.example' >> .gitignore
Load secrets with a startup assertion:
const secret = process.env.JWT_SECRET
if (!secret) throw new Error('JWT_SECRET is required — set it in your deployment environment')
Provide a .env.example with placeholder values only (never real keys) so developers know which variables are required.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Security Hardening Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-798 — Use of Hard-coded Credentials
- cwe · CWE-312 — Cleartext Storage of Sensitive Information
- owasp:2021 · A02 — Cryptographic Failures
- nist:rev5 · SC-28 — Protection of Information at Rest
- soc2:2017 · C1.1 — Identification and protection of confidential information
- soc2:2017 · CC6.1 — Logical access security software, infrastructure, and architectures
Taxons
History
- 2026-04-18·v1.0.0·Initial import from security-hardening·automated
- 2026-07-06·v1.0.1·Add SOC 2 TSC mapping (C1.1, CC6.1) from the verified compliance crosswalk register (docs/compliance/).·by soc2-mapping-enrichment-ship-2