Hardcoded Secret (ARCH7110)

Key php.security.hardcoded-secret · Severity error · Category security · CWE CWE-798

Keeping secrets, API keys, passwords, and private keys as string literals in source gives the credential to anyone with repository access and makes rotation impossible.

Incorrect

<?php
$client = new ApiClient(['api_key' => 'sk_live_4eC39HqLyjWDarjtT1zdp7dc']);

Correct

<?php
$client = new ApiClient(['api_key' => getenv('STRIPE_API_KEY')]);

Fix

Read all secrets from environment variables or a secret manager; never keep them in source control.