Secrets Management

Prevent hardcoded API keys, passwords, and tokens from leaking into source control. This is Finding #4 from Malaysian PDPA court cases -- secrets in public repos are treated as gross negligence.

The Rule

NEVER commit secrets to source code. ALWAYS use environment variables or secret managers.

Detection Patterns

What Counts as a Secret

• API keys (Stripe, OpenAI, AWS, etc.)
• Database connection strings with passwords
• JWT signing keys
• OAuth client secrets
• Webhook signing secrets
• Private keys (RSA, SSH)
• Service account credentials