Hardcoded secret (ARCH3110)
Esta página aún no está disponible en tu idioma.
Key typescript.security.hardcoded-secret · Severity error · Category security · CWE CWE-798
Keeping secrets, API keys, passwords, and private keys as string literals in source lets anyone with repo access capture them. Read them from configuration instead.
Incorrect
Section titled “Incorrect”const stripe = new Stripe("sk_live_51H8xY2eZvKf9aBcDeFgHiJkL");Correct
Section titled “Correct”const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!);Load secrets from environment variables or a secrets manager; keep them out of source control.