Risk Breakdown · Secrets Critical

A hardcoded secret is a master key left under the doormat.

An API key, database URL, or private key committed to your source is the single highest-impact mistake in a pre-launch codebase. One leaked credential can drain an account, breach your users' data, or run up a five-figure cloud bill. And deleting it later doesn't help, because it's still sitting in your git history forever.

What actually counts as a secret

It's not just API_KEY=. IOnclad treats all of these as live credentials that must never reach a repository:

Why it's catastrophic

A leaked secret isn't one bug. It's a skeleton key to whatever it unlocks, and here's what actually goes wrong:

1. Account takeover & data breach

A leaked database URL or cloud key is full read/write to your data. An attacker doesn't need an exploit. They just log in with your credential and export every user record. This is how a huge share of "breaches" actually happen: not a clever hack, a found key.

2. It costs real money, fast

Cloud keys get used to spin up crypto-mining fleets; payment keys get used for fraudulent charges. Public repositories are scraped by bots within minutes of a push. People have woken up to five- and six-figure cloud bills from a single committed AWS key.

3. The git-history trap

This is the one almost everyone gets wrong. You commit a key, notice it, and "remove" it in the next commit. The secret is still there. Anyone with clone access can run git log -p --all and read it out of history. Removing it from the working tree does nothing. It must be rotated and purged.

4. Lateral movement & compliance fallout

One key often unlocks others. An email key sends phishing as you. An internal token opens your other services. And if the leaked credential exposes personal data, you've turned a code mistake into a GDPR / CCPA notification event and a SOC 2 finding.

The shape of a real incident

It almost always looks like this:

# Friday: shipping fast, drop the key in to "just test it"
const stripe = new Stripe("sk_live_51H...redacted...4242");

# Saturday: notice it, "fix" it
const stripe = new Stripe(process.env.STRIPE_KEY);   // looks safe now ✓

# …but `git log -p --all` still returns the Friday commit.
# Three months later, the key is found and the account is drained.

How to fix it (the right way)

• Rotate first, always. If it was ever committed, treat it as compromised and issue a new credential before anything else.
• Move secrets to environment variables or a manager (Doppler, Vault, AWS/GCP Secrets Manager). Never a tracked file.
• Add .env and key files to .gitignore, and add a pre-commit hook so it can't happen again.
• Purge history with git filter-repo or BFG if it must go, but purging is in addition to rotating, never instead of it.
• Scope keys to least privilege so a leak is contained, not total.