No hardcoded API keys or secrets in source

A sk_live_, AKIA, ghp_, or private-key literal inside committed source code is functionally identical to publishing the credential — git history is forever, and secret-scanning services (GitHub's built-in scanner, TruffleHog, GitGuardian) will find it faster than most teams can. The 2022 Uber breach began with a contractor's GitHub-leaked credential, and GitGuardian's 2024 State of Secrets Sprawl report logged 23.8 million fresh secrets pushed to GitHub across 2023. AI coding tools produce this anti-pattern routinely: asked to "add Stripe", they paste the example key from docs inline; asked to "connect to the database", they inline the connection string. Even git rm doesn't help — the blob stays reachable through history until a full rewrite plus credential rotation. Stripe, AWS, and GitHub all auto-revoke detected keys, so the loud failure mode is service outage; the quiet mode is an attacker finding it first and quietly using it.

Move the secret to an environment variable, delete the literal from source, rotate the credential immediately (assume it is compromised the moment it lands in git history).

Deeper remediation guidance and cross-reference coverage for this check lives in the security-hardening Pro audit — run that after applying this fix for a more exhaustive pass on the same topic.

• ID: no-hardcoded-secrets
• Severity: critical
• What to look for: Grep source files (excluding node_modules, .git, build output, .env*) for: sk_live_, sk_test_, rk_live_, pk_live_ (Stripe); AIza (Google); AKIA (AWS); ghp_, gho_, ghs_, github_pat_ (GitHub); xoxb-, xoxp- (Slack); eyJhbGciOi (JWTs); -----BEGIN RSA PRIVATE KEY-----, -----BEGIN OPENSSH PRIVATE KEY-----.
• Pass criteria: Zero matches in any committed source file.
• Fail criteria: Any match, even in comments (comments still ship to the repo).
• Skip (N/A) when: Never — every project should be checked.
• Before evaluating, quote: File path of any match (path only, NEVER the value). If zero, report "0 matches across N source files searched".
• Report even on pass: "Scanned ~X source files, 0 secret patterns matched".
• Detail on fail: "Hardcoded Stripe secret key in src/lib/payments.ts (sk_live_ pattern)" — never include the actual value.
• Remediation: Move to env var, delete the literal, rotate the credential immediately (assume compromised the moment it lands in git history).