Hardcoded Secret (ARCH6110)

Key ruby.security.hardcoded-secret · Severity error · Category security · CWE CWE-798

Embedding secrets, API keys, passwords, and tokens in source exposes them to anyone with repository access. Read secrets from the environment or a vault.

Incorrect

class PaymentClient
  API_KEY = "sk_live_4eC39HqLyjWDarjtT1zdp7dc"

  def charge(amount)
    Stripe::Charge.create(amount: amount, api_key: API_KEY)
  end
end

Correct

class PaymentClient
  def charge(amount)
    Stripe::Charge.create(amount: amount, api_key: ENV.fetch("STRIPE_API_KEY"))
  end
end

Fix

Remove secrets from source and read them from environment variables or a secrets vault.