Sc Secrets

SC: Hardcoded Secrets & Credentials

Purpose

Detects hardcoded secrets, API keys, tokens, passwords, private keys, and credentials embedded in source code, configuration files, and environment files committed to version control. Uses pattern matching for known key formats, entropy analysis for unknown formats, and context analysis to distinguish test keys from production secrets.

Activation

Called by sc-orchestrator during Phase 2. Always runs regardless of detected languages.

Phase 1: Discovery

File Patterns to Search

**/*.ts, **/*.js, **/*.py, **/*.go, **/*.php, **/*.java, **/*.cs,
**/*.rb, **/*.yaml, **/*.yml, **/*.json, **/*.xml, **/*.toml,
**/*.env, **/*.env.*, **/*.cfg, **/*.conf, **/*.ini, **/*.properties,
**/*.config, **/config/*, **/settings/*, **/.env*, **/docker-compose*,
**/*.sh, **/*.bash, **/Dockerfile*, **/.github/workflows/*

Known API Key Patterns

Private Key Detection

"-----BEGIN RSA PRIVATE KEY-----"
"-----BEGIN EC PRIVATE KEY-----"
"-----BEGIN OPENSSH PRIVATE KEY-----"
"-----BEGIN PGP PRIVATE KEY BLOCK-----"
"-----BEGIN DSA PRIVATE KEY-----"
"-----BEGIN PRIVATE KEY-----"

Generic Secret Patterns

# Assignment patterns
"password\s*[=:]\s*[\"'][^\"']{8,}"
"secret\s*[=:]\s*[\"'][^\"']{8,}"
"api_key\s*[=:]\s*[\"'][^\"']{8,}"
"token\s*[=:]\s*[\"'][^\"']{8,}"
"private_key\s*[=:]\s*[\"'][^\"']{8,}"
"auth.*[=:]\s*[\"'][^\"']{8,}"
"credential.*[=:]\s*[\"'][^\"']{8,}"

# Connection strings with embedded passwords
"mongodb://.*:.*@"
"postgres://.*:.*@"
"mysql://.*:.*@"
"redis://.*:.*@"
"amqp://.*:.*@"

High-Entropy String Detection

Flag strings with Shannon entropy > 4.5 in security-sensitive variable assignments.

Phase 2: Verification

Test vs Production Key Distinction

1. Does the key match a known test/example prefix? (e.g., sk_test_, pk_test_, AKIAIOSFODNN7EXAMPLE)
2. Is the file in a test directory?
3. Is the value "changeme", "placeholder", "xxx", "your-key-here"?
4. Is the value loaded from an environment variable at runtime? (os.getenv(), process.env)
5. Is the .env file in .gitignore?

Context Analysis

# FALSE POSITIVE: Environment variable read (not hardcoded)
API_KEY = os.environ.get('API_KEY')

# TRUE POSITIVE: Hardcoded secret
API_KEY = "sk_live_EXAMPLE_KEY_REPLACE_ME"

# FALSE POSITIVE: Test key
STRIPE_KEY = "sk_test_EXAMPLE_KEY"

# TRUE POSITIVE: Production key in code
STRIPE_KEY = "sk_live_EXAMPLE_PROD_KEY"

Severity Classification

• Critical: Production API keys (AWS, Stripe live, database passwords), private keys, JWT signing secrets
• High: Service tokens (GitHub, GitLab, Slack, SendGrid) that grant significant access
• Medium: API keys with limited scope, internal service credentials, publishable keys misidentified as secret
• Low: Test/sandbox keys, example/placeholder values, keys in documentation

Output Format

Finding: SECRET-{NNN}

• Title: Hardcoded {key type} in {file}
• Severity: Critical | High | Medium | Low
• Confidence: 0-100
• File: file/path:line
• Vulnerability Type: CWE-798 (Hardcoded Credentials) | CWE-321 (Hard-coded Cryptographic Key)
• Description: {Service} {key type} found hardcoded in source code.
• Impact: Unauthorized access to {service}, data breach, financial loss, account compromise.
• Remediation: Move secret to environment variable or secrets manager. Rotate the exposed key immediately.
• References: https://cwe.mitre.org/data/definitions/798.html

Common False Positives

1. Environment variable reads — os.getenv("KEY"), process.env.KEY are runtime reads, not hardcoded
2. Test/sandbox keys — sk_test_, pk_test_, keys containing "test", "example", "demo"
3. Placeholder values — "changeme", "your-api-key", "xxx", "TODO"
4. Public keys — SSH public keys, JWT public keys, certificate public keys are not secrets
5. Hash outputs — bcrypt hashes, SHA hashes in migration files are not secrets
6. Base64-encoded non-secrets — base64 strings that are UI assets, not credentials
7. Configuration templates — .env.example files with placeholder values