Briefle words · Code & architecture
Hardcoded secret
A password, API key or token written directly into source code, where anyone who can read the code can find and misuse it.
Say it to an AI
TypeScript config module for our Node API that reads DATABASE_URL, COURIER_API_KEY and TRACKING_API_URL from environment variables, Twelve-Factor style. Validate them with zod at startup so the app fails fast, and no hardcoded secrets or URLs anywhere in the code.
How an expert would brief the stronger version of “App configuration”.
See it
Try it as a puzzle →The config file of a delivery company's backend, with its database, payment and tracking settings.
Why: B's fallbacks 'postgres://admin:Pa55w0rd@…/prod' and 'cour_live_8Hq2…' are live credentials written into the source; reading 'process.env' first doesn't stop them sitting in the repository.
Related words
Room 1 · Essentials
Learn “Hardcoded secret” in a five-minute lesson