DEV Community

Cover image for Hardcoded Secrets: The #1 Vulnerability AI Agents Can Auto-Fix
Ofri Peretz
Ofri Peretz

Posted on

Hardcoded Secrets: The #1 Vulnerability AI Agents Can Auto-Fix

#javascript #security #eslint #devops

Every week, secrets leak. API keys committed to GitHub. Database passwords in config files. AWS credentials in environment variable defaults.

The fix is trivial. The detection is not.

Until now.

The Problem 

// ❌ This ships to production more than you'd think
const db = new Pool({
  host: 'prod-db.example.com',
  user: 'admin',
  password: 'super_secret_password_123', // CWE-798
});

const stripe = new Stripe('sk_live_abc123xyz789'); // Hardcoded API key
Enter fullscreen mode Exit fullscreen mode

These patterns are obvious in isolation. In a 50,000-line codebase? They hide in plain sight.

Why Traditional Tools Fail

Tool Problem
grep for "password" Too many false positives
Secret scanners Only catch committed secrets
Code review Humans miss things

The ESLint Solution 

// eslint.config.js
import secureCoding from 'eslint-plugin-secure-coding';

export default [secureCoding.configs.recommended];
Enter fullscreen mode Exit fullscreen mode

Now run npx eslint . and get:

src/db.ts
  5:3  error  🔒 CWE-798 OWASP:A02 CVSS:7.5 | Hardcoded credential detected
              Fix: Use environment variable: process.env.DATABASE_PASSWORD
Enter fullscreen mode Exit fullscreen mode

The Fixed Code 

// ✅ Secure pattern
const db = new Pool({
  host: process.env.DATABASE_HOST,
  user: process.env.DATABASE_USER,
  password: process.env.DATABASE_PASSWORD,
});

const stripe = new Stripe(process.env.STRIPE_SECRET_KEY);
Enter fullscreen mode Exit fullscreen mode

Why AI Agents Love This Rule

The error message is structured for AI consumption:

  • CWE-798: Machine-readable vulnerability ID
  • Fix instruction: Exact pattern to apply
  • Location: Precise line and column

Cursor, Copilot, and Claude can read this and auto-fix without human intervention.

Quick Install 

npm install --save-dev eslint-plugin-secure-coding
Enter fullscreen mode Exit fullscreen mode 
// eslint.config.js
import secureCoding from 'eslint-plugin-secure-coding';
export default [secureCoding.configs.recommended];
Enter fullscreen mode Exit fullscreen mode

That's it. One line of config. 89 security rules. Zero hardcoded secrets.

📦 npm: eslint-plugin-secure-coding
📖 Rule docs: no-hardcoded-credentials

🚀 Follow me for more security articles & updates:
GitHub | LinkedIn

Top comments (0)