Source code
Security & compliance
Commented-out secret
Part of the AI-generated code risks check · fix arrives as a pull request
What it is
A commented-out line still contains a real credential — an API key, password, or connection string left behind when the code around it was replaced.
Why it matters
Commenting out a secret does not rotate it. It stays valid, stays in git history, and is indistinguishable from a live key to anyone who gets read access to the repository.
How to fix it
Rotate the credential first — it should be treated as compromised — then delete the line. Move the working value to an environment variable and add the file pattern to .gitignore if it is not already there.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.