Secrets: a committed .env, API keys, private keys

Files and folders: one of the ways AI coding agents bloat software, from lessloc's pattern catalog. lessloc catches it as secret.

What makes secrets (a committed .env, API keys, private keys) a bad practice?

The standards that call it a bad practice: CWE-798 Use of Hard-coded Credentials; CWE-540.

What does lessloc do about secrets (a committed .env, API keys, private keys)?

lessloc catches it as secret.

• secret (tier 0): A credential in a known format in the added lines, or a new .env file that would be committed.

Examples

Caught as secret:

export const stripe = "sk_live_51HxQz2eZvKYlo2C8a9Gm4Rt7Uv0Wx3Yz";

Written well:

export const stripe = process.env.STRIPE_KEY;

Related patterns

The other patterns in Files and folders:

• Scratch, backup, copy and harness files: lessloc catches it as junk-file and refuses it before it lands.
• Caches, build output and logs about to be committed: lessloc catches it as junk-file.
• CI workflows and Dockerfiles nobody asked for: lessloc catches it as unrequested-file.
• Tiny one-function files; file-per-concern splits: lessloc catches it as tiny-file and new-files.
• New folders for one or two files; layer trees for small apps: lessloc catches it as new-folder.
• Junk-drawer utils and helpers modules and folders: lessloc catches it as junk-drawer.
• Vague names (process_data, handle): lessloc catches it as vague-name.
• Moving or renaming files without a reason: lessloc catches it as moved-files.