GitHub
Security & compliance
Code quality
Hardcoded provider API token
Part of the Secret hygiene check · fix arrives as a guide
What it is
A provider API token or access key is written as a literal in a source file.
Why it matters
It is live, it is in git history, and anyone with repository access has it. Removing the line in a later commit does not remove it from history or invalidate the credential.
How to fix it
Rotate the token now — assume it is compromised — then read it from the environment. Purging history is optional once the credential is dead, and is the harder half of the job.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.