GitHub
Code quality
Security & compliance
Releases
Config value hardcoded instead of env var
Part of the Env & config hygiene check · fix arrives as a guide
What it is
A configuration value is written as a literal in source — a URL, a bucket name, a feature toggle, an account identifier — where it should be read from the environment.
Why it matters
The value cannot differ per environment, so staging points at production resources or the code needs editing per deploy. Both routes end with someone running a test against live data.
How to fix it
Move it to an environment variable with a sensible default for local development, and read it in one place so the coupling is visible.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.