A hardcoded secret is a credential, an API key, password, database URL, or token, written as a literal value directly in source code instead of being loaded from a secure configuration like an environment variable. It is dangerous because anyone who can read the code, or its git history, gets the credential, and public code is scraped by bots within minutes.
Why it is the top flaw in AI code
We scanned nearly 2,000 AI-built apps and a hardcoded secret was the number one high-severity finding in every corpus. The reason is simple: inlining the value is the shortest path to code that runs, and an AI assistant optimizes for running code, so it reaches for the literal key.
Why deleting it later is not enough
Once a secret has been committed, it lives in your git history even after you remove the line, and any public exposure means it has likely already been copied. The only real fix is to rotate (regenerate) the credential, then move the new one to an environment variable.
Where a hardcoded secret leaks from
| Where the key ends up | Who can read it |
|---|---|
| A client-side bundle | Every visitor, via view-source or the network tab |
| A public git repo | Anyone, plus bots that scrape new commits within minutes |
| A private repo's history | Anyone with repo access, even after you delete the line |
| An environment variable (correct) | Only your server process |
What this means for AI-generated code
Every AI coding tool does this, at a statistically similar rate. The fix is not choosing a better tool; it is keeping secrets in environment variables and putting a secret scanner in front of your commits so an inline key cannot ship.
Common questions
How do I find hardcoded secrets in my code?
Run a secret scanner over your repository and its git history. Prbl scans a public repo or a live URL for exposed keys for free. Common patterns are long random strings assigned to variables named key, token, secret, or password, and provider prefixes like sk_ or eyJ.
I deleted the secret from my code. Am I safe now?
No. The value still exists in your git history, and if the repo was ever public it may already have been copied. You have to rotate the credential, generate a new one and revoke the old, then store the new one in an environment variable.
Why do AI coding tools hardcode secrets so often?
Inlining the value is the shortest path to code that runs, and an assistant optimizes for working code. Across the AI-built apps we scanned, a hardcoded secret was the single most common high-severity finding, at a similar rate across every tool.
Does keeping the repo private make hardcoding safe?
It reduces exposure but does not make it safe. The secret is still in plain text in the history, readable by every collaborator and anyone who later gains access, and one accidental push or fork makes it public. Secrets belong in environment variables regardless of repo visibility.