Secret-named setting assigned a literal value

Warning — the name is the evidence: very likely a secret, reported so a human can decide.

What it catches

DB_PASSWORD=hunter2 in a .env, "client_secret": "…" in a JSON config, api_key = '…' in a settings module, password: … in a YAML manifest — a key whose name says secret, given a literal instead of a reference. The name is the evidence, so this is a warning rather than a certainty: the scanner stays silent when the value is a placeholder, an environment or template reference, a hash, a type annotation, or a word like example or test, and on names that merely contain the word (password_hash, token_type, api_key_id).

Fires on

DB_PASSWORD=hunter2
STRIPE_SECRET="sk_live_…"
"client_secret": "0f3a…"

Do this instead

Keep the name, drop the value: read it from the environment or a secret manager at runtime and commit a placeholder or an example file (.env.example with empty values). Rotate anything that was already committed — git history keeps it.

DB_PASSWORD=${DB_PASSWORD}
# or, in .env.example:
DB_PASSWORD=

Catch this before it ships

This rule runs locally in the free CLI — or with the full corpus through the hosted service: npx bolvrk secrets "src/**" ".env*"

Browse all 69 rules

← BC005