What it does
Detects string literals assigned to variables with names that suggest they contain secrets: `password`, `secret`, `apiKey`, `token`, `privateKey`, `credential`, `authToken`, and similar patterns.
Why AI tools generate this pattern
AI tools frequently generate example code with placeholder credentials that look like this: ```typescript const API_KEY = 'sk-proj-abc123...'; // ← real-looking key const DB_PASSWORD = 'mypassword123'; // ← placeholder that never gets replaced ``` These values are often copied verbatim into production code, pushed to version control, and exposed publicly. Scanning historical git history for leaked credentials is a standard attack technique. Once a secret is committed, it must be treated as compromised even after deletion. This is not theoretical — leaked API keys in public repositories are discovered within minutes by automated scanners.
Code Examples
// Hardcoded credentials — will be committed to version control
const stripeKey = 'sk_live_abc123456789';
const dbPassword = 'SuperSecret123!';
const jwtSecret = 'my-jwt-signing-secret';
// Configuration objects with embedded secrets
const config = {
apiKey: 'AIzaSyAbc123...',
authToken: 'Bearer eyJhbGciOiJIUzI1NiJ9...',
};// Read from environment variables
const stripeKey = process.env.STRIPE_SECRET_KEY;
const dbPassword = process.env.DB_PASSWORD;
const jwtSecret = process.env.JWT_SECRET;
// Validate at startup that secrets are present
if (!stripeKey) {
throw new Error('STRIPE_SECRET_KEY environment variable is required');
}
// Use a secrets manager (AWS SSM, Vault, etc.)
const secret = await secretsManager.getSecretValue({ SecretId: 'prod/stripe/key' });Safe Autofix
This rule supports a safe autofix for hardcoded string values that match secret-like variable/property names.
Before fix:
const apiKey = 'sk-live-abc123';After fix:
const apiKey = process.env.API_KEY;How to Fix
- Move secrets to environment variables and read them with `process.env.YOUR_SECRET`
- Use a `.env` file locally (add to `.gitignore`) and a secrets manager in production
- Rotate any secrets that were previously hardcoded and committed
Nuances & False Positive Prevention
Legitimate usage can be exempted with inline disable comments (// ai-guard-disable-next-line no-hardcoded-secret) when appropriate.
Configuration
Enable or override this rule in your ESLint configuration:
// eslint.config.mjs
export default [
{
plugins: { 'ai-guard': aiGuard },
rules: {
'ai-guard/no-hardcoded-secret': 'error',
},
},
];