# Hardcoded Secrets in Makefiles

> Detects API keys, tokens, and passwords hardcoded in Makefile targets and variables.

- Skill: `zakirkun/hardcoded-secrets-in-makefiles` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/hardcoded-secrets-in-makefiles`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/hardcoded-secrets-in-makefiles/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/hardcoded-secrets-in-makefiles

---


# Hardcoded Secrets in Makefiles

## Overview
Makefiles often contain deployment commands that require credentials. These credentials hardcoded in Makefiles are committed to version control and visible in CI/CD logs.

## Remediation
- Use environment variables for all credentials: `$(API_KEY)` from shell environment
- Use `.env` files loaded before `make` commands (not committed)
- Use vault agents or cloud secrets in production pipelines