Rule Definition
Hard-coding API keys directly in source code is a critical security vulnerability. When API keys are embedded in TypeScript files, they are easily exposed through version control history (e.g., Git), public repositories, compiled JavaScript bundles, client-side code shipped to browsers, and log files or error messages. Attackers who obtain these keys can abuse third-party services, incur financial charges on your accounts, access sensitive data, or escalate privileges. Secrets should always be externalized and managed through secure mechanisms.

Remediation
Replace any hard-coded API key with an environment variable or a secrets management solution. In TypeScript/Node.js, use process.env to read secrets at runtime. For frontend applications, use build-time environment variable injection (e.g., via .env files with tools like Vite or Next.js), while ensuring keys are never committed to source control. Add .env files to .gitignore and consider using a dedicated secrets manager (AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) for production environments.

Violation Code Sample

const openAiHeaders = {
  'Authorization': 'Bearer sk-AbCdEf123456GhIjKlMnOpQrStUvWxYz',  // ❌ Violation : Hard-coded API key
  'Content-Type': 'application/json',
};

Fixed Code Sample

import Stripe from 'stripe';
import dotenv from 'dotenv';

dotenv.config(); // loads variables from .env file (never commit .env to git)

const stripeApiKey = process.env.STRIPE_SECRET_KEY;  // ✅ Fixed : Load secrets from environment variable
const openAiApiKey = process.env.OPENAI_API_KEY;     // ✅ Fixed : Load secrets from environment variable

if (!stripeApiKey || !openAiApiKey) {
  throw new Error('Missing required API keys in environment variables.');
}

const stripe = new Stripe(stripeApiKey, {
  apiVersion: '2023-10-16',
});

const openAiHeaders = {
  'Authorization': `Bearer ${openAiApiKey}`,
  'Content-Type': 'application/json',
};
```

**`.env` file (local only — add to `.gitignore`):**
```
STRIPE_SECRET_KEY=...
OPENAI_API_KEY=...
```

**`.gitignore`:**
```
.env
.env.local
.env.production

CWE-547: Use of Hard-coded, Security-relevant Constants https://cwe.mitre.org/data/definitions/547.html CWE-798: Use of Hard-coded Credentials https://cwe.mitre.org/data/definitions/798.html OWASP – Secrets Management Cheat Sheet – Secrets Management Cheat Sheet https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html OWASP Top Ten 2021 – A02:2021 Cryptographic Failures https://owasp.org/Top10/2021/A02_2021-Cryptographic_Failures/ OWASP Top Ten 2025 - A07:2025 - Authentication Failures https://owasp.org/Top10/2025/A07_2025-Authentication_Failures/ Node.js dotenv package https://nodejs.org/api/environment_variables.html#dotenv 12-Factor App – Config — industry standard for externalizing configuration from code