Code Smell 258 - Secrets in Code
Tags: webdev, beginners, programming, security
Published: 2024-07-13 16:25:27

*The Dangers of Hardcoding Secrets*

> TL;DR: Use a secret manager to avoid hardcoding sensitive information.

# Problems

- Security risk

- Hard to update by operations teams

- Code exposure

- Data breaches

- Audit Fails

# Solutions

1. Use a [secrets manager](https://en.wikipedia.org/wiki/Key_management)

2. Use Environment variables outside the code

3. Encrypted storage

# Context

Writing secrets as plain text directly into your codebase exposes your code to significant security risks. 

Hardcoded secrets such as API keys, passwords, database credentials, and tokens can be easily exposed if your code is shared or compromised. 

Use a secret manager to store and manage your secrets.

This strategy will reduce the risk of data breaches and make it easier to update and rotate secrets as needed.

# Sample Code

## Wrong

[Gist Url]: # (https://gist.github.com/mcsee/9f6389d74995cdebda3e81f5e9831fbe)

```python
import requests

api_key = "LILAS_PASTIA"
response = requests.get("https://api.example.com", 
           headers={"Authorization": f"Bearer {api_key}"})
```

## Right

[Gist Url]: # (https://gist.github.com/mcsee/8ce54f7836bdc9552d505b9d350ee8d1)

```python
import os
import requests

api_key = os.environ.get("API_KEY")
# This is just an example. Might also be not as secure

response = requests.get("https://api.example.com", 
           headers={"Authorization": f"Bearer {api_key}"})
```

# Detection

[X] Automatic 

You can detect this smell by searching your codebase for hardcoded strings that resemble secrets. 

Code reviews and commercial security static analysis tools can also help identify these patterns.

# Tags

- Security

# Level

[x] Intermediate

# AI Generation

AI code generators might create this smell if they were trained with code datasets with hardcoded secrets. 

Always review generated code to ensure secrets are handled securely.

# AI Detection

Gemini, Claude, and ChatGPT detected the hardcoded secrets and suggested changes to the code.

# Conclusion

Using a secret manager enhances the security and maintainability of your code by ensuring that sensitive information is stored securely and can be easily managed and updated.

Many repl and public codebases have a secret manager as an external utility.

Make it a habit to handle all secrets with care and never let them slip into your codebase.

# Relations

{% post https://dev.to/mcsee/code-smell-215-deserializing-object-vulnerability-3hbj %}

{% post https://dev.to/mcsee/code-smell-189-not-sanitized-input-853 %}

# More Info

[Stack Overflow](https://stackoverflow.com/questions/70559637/github-copilot-giving-away-api-keys-how-can-i-protect-my-keys)

[GitHub Copilot security concerns](https://vlad-rad.medium.com/github-copilot-security-conserns-d4209f0d5c28)

# Disclaimer

Code Smells are my [opinion](https://dev.to/mcsee/i-wrote-more-than-90-articles-on-2021-here-is-what-i-learned-1n3a).

# Credits

Photo by [saeed karimi](https://unsplash.com/@saeedkarimi) on [Unsplash](https://unsplash.com/photos/woman-in-white-long-sleeve-shirt-kissing-girl-in-white-long-sleeve-shirt-JrrWC7Qcmhs)
  
* * *

> Passwords are like underwear: you don’t let people see it, you should change it very often, and you shouldn’t share it with strangers.

_Chris Pirillo_
 
{% post https://dev.to/mcsee/software-engineering-great-quotes-26ci %}

* * *

This article is part of the CodeSmell Series.

{% post https://dev.to/mcsee/how-to-find-the-stinky-parts-of-your-code-1dbc %}