SEC-001: No Hardcoded Secrets in Source Code

Attribute	Value
Category	Security Standards
Default Severity	error
Applicable Files	All source code (excluding test mock fixtures and YAML)

Why It Exists (Rationale)

Hardcoded secrets in application source files represent one of the most common and catastrophic vulnerability vectors (OWASP Top 10). Once committed:

• Keys persist indefinitely in Git commit history even after subsequent deletion commits.
• Credentials get cloned to every developer machine, CI server, and fork.
• Leaked credentials allow attackers unauthorized database access, cloud account hijacking, and data breaches.

Credentials must always be provided dynamically at runtime through secure environment variables or secret vaults (AWS Secrets Manager, GCP Secret Manager, HashiCorp Vault).

Bad Example

// ❌ Hardcoded tokens and API keys in source files
export const stripeClient = new Stripe("sk-test-demo-mock-secret-key-1234567890");

export const s3Config = {
  accessKeyId: "AKIAIOSFODNN7EXAMPLE",
  secretAccessKey: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
};

export const adminPassword = "superSecretPassword123!";

Good Example

// ✅ Injected dynamically via environment variables
export const stripeClient = new Stripe(process.env.STRIPE_SECRET_KEY!);

export const s3Config = {
  accessKeyId: process.env.AWS_ACCESS_KEY_ID!,
  secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY!,
};

How It's Detected

ArchStandards applies high-entropy regex pattern matching against known key formats:

• AWS Access Keys (AKIA[A-Z0-9]{16})
• GitHub Personal Access Tokens (ghp_[a-zA-Z0-9]{36})
• OpenAI / Stripe secret keys (sk-[a-zA-Z0-9]{20,})
• Common secret assignments (api_key = "...", password = "...", token = "...")

Exception Configuration

exceptions:
  - rule: "SEC-001"
    path: "src/testing/dummy-fixtures.ts"
    reason: "Dummy mock tokens used solely for local unit test fixtures."