How to Remove Hardcoded Credentials From Source Code

Why hardcoded credentials are a critical finding

When a secret is hardcoded in source code, it leaks on every surface:

• git history - even after you remove it, every old commit still has it; anyone with a clone has it forever
• filesystem access - if an attacker reads app.py on a compromised server, they get the database password immediately
• accidental sharing - a screenshot, a pastebin, a public fork - and the credential is out

The fix is to inject secrets at runtime through the environment and never write them into files that enter version control.

The pattern: os.environ reads

Before - credentials hardcoded in source:

# BAD: anyone who can read app.py has these credentials
DB_PASSWORD = "dev"
API_SECRET_KEY = "s3cr3t-k3y-f0r-t0k3ns"

After - values come from the runtime environment:

import os

DB_PASSWORD = os.environ["DB_PASSWORD"]
API_SECRET_KEY = os.environ["API_SECRET_KEY"]

os.environ["VAR_NAME"] raises KeyError at startup if the variable is missing - which is the right behavior. It makes a misconfigured deployment fail fast and loudly rather than running with a blank or wrong credential. Use os.environ.get("VAR_NAME", default) only when a missing value is genuinely acceptable.

How environment variables get set

In local development, set them in your shell or a .env file that is never committed (add .env to .gitignore):

export DB_PASSWORD="dev"
export API_SECRET_KEY="s3cr3t-k3y-f0r-t0k3ns"
python3 app.py

In production, secrets are injected by the runtime:

• Docker / Compose - environment: block or --env-file (still keep the file out of git)
• Kubernetes - a Secret object mounted as env vars; the pod spec references it by name, never contains the value
• AWS / GCP / Azure - managed secrets services (AWS Secrets Manager, GCP Secret Manager) that return the value at runtime via SDK call, never via a file on disk

Adding a pre-commit guard

The longer-term protection is blocking the secret from ever reaching git. gitleaks and trufflehog both run as pre-commit hooks and match common credential patterns (API key prefixes, high-entropy strings, known service formats):

# install gitleaks and add a pre-commit hook
gitleaks detect --source . --verbose

A CI check that runs the same scan on every pull request catches anything a developer's local hook missed.

Rotating after a leak

If a secret was already committed, removal alone is not enough. The credential is in every clone. The required steps are: (1) revoke and rotate the credential immediately, (2) rewrite history with git filter-repo to scrub the value, and (3) force-push with a coordinated team heads-up. Assume every clone made before the rotation is compromised.