Production config file with hardcoded values
Part of the Env & config hygiene check · fix arrives as a guide
What it is
A production configuration file in the repository contains literal values — endpoints, identifiers, or credentials — rather than references to environment variables.
Why it matters
Anything in that file is in git history and visible to everyone with repository access. If any of it is a credential, rotation now requires a commit, and the old value stays in history regardless.
How to fix it
Replace the literals with environment references, rotate anything credential-shaped, and move production configuration into your platform's secret store where access can be granted and revoked separately from the code.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.