# Secrets: a committed `.env`, API keys, private keys

*Files and folders*: one of the ways AI coding agents bloat software, from lessloc's [pattern catalog](https://lessloc.org/patterns/index.md). lessloc catches it as [`secret`](https://lessloc.org/guide/reference.md#tier-0).

## What makes secrets (a committed .env, API keys, private keys) a bad practice?

The standards that call it a bad practice: [CWE-798](https://cwe.mitre.org/data/definitions/798.html) Use of Hard-coded Credentials; [CWE-540](https://cwe.mitre.org/data/definitions/540.html).

## What does lessloc do about secrets (a committed .env, API keys, private keys)?

lessloc catches it as [`secret`](https://lessloc.org/guide/reference.md#tier-0).

- `secret` (tier 0): A credential in a known format in the added lines, or a new `.env` file that would be committed.

## Examples

Caught as `secret`:

```js [k.js]
export const stripe = "sk_live_51HxQz2eZvKYlo2C8a9Gm4Rt7Uv0Wx3Yz";
```

Written well:

```js [k.js]
export const stripe = process.env.STRIPE_KEY;
```

## Related patterns

The other patterns in [Files and folders](https://lessloc.org/patterns/index.md#files-and-folders):

- [Scratch, backup, copy and harness files](https://lessloc.org/patterns/index.md#scratch-files): lessloc catches it as `junk-file` and refuses it before it lands.
- [Caches, build output and logs about to be committed](https://lessloc.org/patterns/index.md#caches): lessloc catches it as `junk-file`.
- [CI workflows and Dockerfiles nobody asked for](https://lessloc.org/patterns/scaffolding.md): lessloc catches it as `unrequested-file`.
- [Tiny one-function files; file-per-concern splits](https://lessloc.org/patterns/tiny-files.md): lessloc catches it as `tiny-file` and `new-files`.
- [New folders for one or two files; layer trees for small apps](https://lessloc.org/patterns/one-file-folders.md): lessloc catches it as `new-folder`.
- [Junk-drawer utils and helpers modules and folders](https://lessloc.org/patterns/junk-drawer.md): lessloc catches it as `junk-drawer`.
- [Vague names (process\_data, handle)](https://lessloc.org/patterns/vague-name.md): lessloc catches it as `vague-name`.
- [Moving or renaming files without a reason](https://lessloc.org/patterns/moved-files.md): lessloc catches it as `moved-files`.