GitHub Code quality Security & compliance Releases

Config value hardcoded instead of env var

Part of the Env & config hygiene check · fix arrives as a guide

What it is

A configuration value is written as a literal in source — a URL, a bucket name, a feature toggle, an account identifier — where it should be read from the environment.

Why it matters

The value cannot differ per environment, so staging points at production resources or the code needs editing per deploy. Both routes end with someone running a test against live data.

How to fix it

Move it to an environment variable with a sensible default for local development, and read it in one place so the coupling is visible.

Run them all on your app

Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.