Hardcoded Secrets in Security Operations

Description

Detects hardcoded secrets (API keys, tokens, passwords) flowing into security-sensitive operations. Uses taint analysis to track hardcoded secret strings from their definition to actual usage in authentication, API calls, or cryptographic operations. This approach reduces false positives by only flagging secrets that are actually used, not just defined in comments, examples, or unused variables.

What Shoulder detects

Hardcoded {source_description} flows directly to security-sensitive operation at {sink}.
This creates security risks:
- Exposure in version control
- Difficult credential rotation
- Accidental disclosure in logs/errors
- No separation between dev/prod environments

How to fix

Load secrets from environment variables instead of hardcoding:

```javascript
require('dotenv').config();

const stripe = require('stripe')(process.env.STRIPE_API_KEY);

if (!process.env.STRIPE_API_KEY) {
  throw new Error('STRIPE_API_KEY environment variable required');
}
```

Learn more: https://shoulder.dev/learn/javascript/cwe-798/hardcoded-secrets

Applies to

Languages

🟨 JavaScript 🔷 TypeScript

Frameworks

nodejs express fastify koa hapi nestjs

References

Documentation ↗ OWASP ↗ Learn about CWE-798

Scan for this issue

Detect with Shoulder CLI

npx @shoulderdev/cli trust --rule=javascript-hardcoded-secrets-experimental .