VBC-001: hardcoded-secret

error

Category: core
Analysis: Regex (line by line)
File types: .js, .ts, .tsx, .py, .env, .yaml, .yml, .json, .astro
Scope: source code only, ignoring anything inside strings and comments
Excluded paths: **/test/**, **/tests/**, **/__tests__/**, **/testdata/**, **/fixtures/**, **/test_*.py, **/*_test.py, **/test.py, **/conftest.py, **/*_test.go, **/*_bench.go, **/*.test.*, **/*.spec.*
Tags: security secrets

What it reports

Hardcoded credential at line {line}. Read it from the environment. Values that name what they are, such as CHANGEME or a fixture spelling out "secret", are not reported: they describe a field rather than hold a key.

Flagged

AWS_SECRET_ACCESS_KEY = "wJalrXUtnFEMI/K7MDENG/bPxRfiCY"

const password = "hunter2abc";

api_key: "A9dK2mQ7xR4vL8nP1sT6wY3z"

token = "ghp_9fK2mQ7xR4vL8nP1sT6wY3zB5cE0"

Not flagged

PASSWORD = "correct horse battery staple"

api_key = "lm-studio"

secret = "user-message-content-visible-in-trace"

const secretary = "Ada Lovelace 1843"

const password = process.env.PASSWORD;

const token = "";

secret = "REAL-HMAC-SECRET"

api_key: "your-api-key-here"

access_key = "AKIAIOSFODNN7EXAMPLE"

const TAM_TOKEN_ADDRESS = '0xe7f1725E7734CE288F8367e1Bb143E90bb3F0512';

token_address = "0xe7f1725E7734CE288F8367e1Bb143E90bb3F0512"

Pattern

(?<![A-Za-z])(api_key|secret|password|passwd|token|bearer|auth[_-]?key|access[_-]?key)(?![A-Za-z])[\w]*(?<![_-]addr)(?<![_-]address)\s*[:=]\s*['"\`](?![^'"\`]*(?:secret|password|passwd|token|apikey|api[_-]?key|credential|dummy|example|sample|test|fake|changeme|placeholder|your[_-]|xxx|\.\.\.))(?=[^'"\`]*\d)(?![^'"\`]* )([^'"\`]){8,}