Source code
Security & compliance
Code quality
Releases
Hardcoded config / credential
Part of the Production readiness check · fix arrives as a pull request
What it is
A configuration value or credential is written as a literal in source rather than read from the environment.
Why it matters
It cannot differ between environments, so staging and production share it or the value is simply wrong in one of them. If it is a credential, rotating it now requires a code change and a deploy.
How to fix it
Move the value to an environment variable, read it once at startup, and fail fast if it is missing. Rotate anything that was committed — it is in the git history regardless of the change that removes it.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.