description: No Hardcoded Credentials
alwaysApply: true
rule_id: codeguard-1-hardcoded-credentials
No Hardcoded Credentials
NEVER store secrets, passwords, API keys, tokens or any other credentials directly in source code.
Treat your codebase as public and untrusted. Any credential that appears in source code is compromised and must be handled through secure alternatives.
NEVER hardcode these types of values:
Passwords and Authentication:
- Database passwords, user passwords, admin passwords
- API keys, secret keys, access tokens, refresh tokens
- Private keys, certificates, signing keys
- Connection strings containing credentials
- OAuth client secrets, webhook secrets
- Any other credentials that could be used to access external services
Recognition Patterns - Learn to Spot These Formats
Common Secret Formats You Must NEVER Hardcode:
- AWS Keys: Start with
AKIA, AGPA, AIDA, AROA, AIPA, ANPA, ANVA, ASIA
- Stripe Keys: Start with
sk_live_, pk_live_, sk_test_, pk_test_
- Google API: Start with
AIza followed by 35 characters
- GitHub Tokens: Start with
ghp_, gho_, ghu_, ghs_, ghr_
- JWT Tokens: Three base64 sections separated by dots, starts with
eyJ
- Private Key Blocks: Any text between
-----BEGIN and -----END PRIVATE KEY-----
- Connection Strings: URLs with credentials like
mongodb://user:pass@host
Warning Signs in Your Code:
- Variable names containing:
password, secret, key, token, auth
- Long random-looking strings that are not clear what they are
- Base64 encoded strings near authentication code
- Any string that grants access to external services
You must always explain how this rule was applied and why it was applied.
1---2name: 208-control-set-ext-10-hardcoded-credentials-e5efa34d3description: <!-- Threat Modeling Skill | Version 3.0.0 (20260201a) | https://github.com/fr33d3m0n/threat-modeling | License: BSD-3-Clause -->4---5<!-- Threat Modeling Skill | Version 3.0.0 (20260201a) | https://github.com/fr33d3m0n/threat-modeling | License: BSD-3-Clause -->67---8description: No Hardcoded Credentials9alwaysApply: true10---1112rule_id: codeguard-1-hardcoded-credentials1314# No Hardcoded Credentials1516NEVER store secrets, passwords, API keys, tokens or any other credentials directly in source code.1718Treat your codebase as public and untrusted. Any credential that appears in source code is compromised and must be handled through secure alternatives.1920#### NEVER hardcode these types of values:2122Passwords and Authentication:23- Database passwords, user passwords, admin passwords24- API keys, secret keys, access tokens, refresh tokens25- Private keys, certificates, signing keys26- Connection strings containing credentials27- OAuth client secrets, webhook secrets28- Any other credentials that could be used to access external services293031#### Recognition Patterns - Learn to Spot These Formats3233Common Secret Formats You Must NEVER Hardcode:3435- AWS Keys: Start with `AKIA`, `AGPA`, `AIDA`, `AROA`, `AIPA`, `ANPA`, `ANVA`, `ASIA`36- Stripe Keys: Start with `sk_live_`, `pk_live_`, `sk_test_`, `pk_test_`37- Google API: Start with `AIza` followed by 35 characters38- GitHub Tokens: Start with `ghp_`, `gho_`, `ghu_`, `ghs_`, `ghr_`39- JWT Tokens: Three base64 sections separated by dots, starts with `eyJ`40- Private Key Blocks: Any text between `-----BEGIN` and `-----END PRIVATE KEY-----`41- Connection Strings: URLs with credentials like `mongodb://user:pass@host`4243Warning Signs in Your Code:44- Variable names containing: `password`, `secret`, `key`, `token`, `auth`45- Long random-looking strings that are not clear what they are46- Base64 encoded strings near authentication code47- Any string that grants access to external services4849You must always explain how this rule was applied and why it was applied.
tools-only