Hardcoded secret (ARCH3110)
Ce contenu n’est pas encore disponible dans votre langue.
Key typescript.security.hardcoded-secret · Severity error · Category security · CWE CWE-798
Keeping secrets, API keys, passwords, and private keys as string literals in source lets anyone with repo access capture them. Read them from configuration instead.
Incorrect
Section titled “Incorrect”const stripe = new Stripe("sk_live_51H8xY2eZvKf9aBcDeFgHiJkL");Correct
Section titled “Correct”const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!);Load secrets from environment variables or a secrets manager; keep them out of source control.