A hardcoded secret is a credential, an API key, password, database URL, or token, written as a literal value directly in source code instead of being loaded from a secure configuration like an environment variable. It is dangerous because anyone who can read the code, or its git history, gets the credential, and public code is scraped by bots within minutes.
Why it is the top flaw in AI code
We scanned nearly 2,000 AI-built apps and a hardcoded secret was the number one high-severity finding in every corpus. The reason is simple: inlining the value is the shortest path to code that runs, and an AI assistant optimizes for running code, so it reaches for the literal key.
Why deleting it later is not enough
Once a secret has been committed, it lives in your git history even after you remove the line, and any public exposure means it has likely already been copied. The only real fix is to rotate (regenerate) the credential, then move the new one to an environment variable.
What this means for AI-generated code
Every AI coding tool does this, at a statistically similar rate. The fix is not choosing a better tool; it is keeping secrets in environment variables and putting a secret scanner in front of your commits so an inline key cannot ship.