Hardcoded secret (ARCH3110)

Key typescript.security.hardcoded-secret · Severity error · Category security · CWE CWE-798

Keeping secrets, API keys, passwords, and private keys as string literals in source lets anyone with repo access capture them. Read them from configuration instead.

Incorrect

const stripe = new Stripe("sk_live_51H8xY2eZvKf9aBcDeFgHiJkL");

Correct

const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!);

Fix

Load secrets from environment variables or a secrets manager; keep them out of source control.