Hardcoded Secrets in Source Code
Description
API keys, passwords, or tokens hardcoded in source code.
How to fix
Load secrets from environment variables instead of hardcoding them.
```go
import "os"
apiKey := os.Getenv("API_KEY")
if apiKey == "" {
log.Fatal("API_KEY not set")
}
```
Learn more: https://shoulder.dev/learn/go/cwe-798/hardcoded-secrets
Applies to
Languages
References
Scan for this issue
Detect with Shoulder CLI
npx @shoulderdev/cli trust --rule=go-hardcoded-secrets .