zakirkun Hardcoded Secrets in Makefiles
Overview
Makefiles often contain deployment commands that require credentials. These credentials hardcoded in Makefiles are committed to version control and visible in CI/CD logs.
Remediation
- Use environment variables for all credentials:
$(API_KEY)from shell environment - Use
.envfiles loaded beforemakecommands (not committed) - Use vault agents or cloud secrets in production pipelines