Glossary

Hard-Coded Secret

What Is a Hard-Coded Secret?

A hard-coded secret is a credential — API key, password, private key, authentication token, or similar — that is embedded directly inside software code or compiled artifacts, often inadvertently, making it accessible to anyone who can read the artifact.

Hard-coded secrets are one of the most common and most damaging categories of non-CVE risk. They survive into shipped products, persist in firmware for years, and grant attackers direct access without requiring an exploit. Source-code scanners catch some of these during development; binary analysis catches the rest — including secrets introduced by the build system, baked into third-party components, or present in artifacts where source code is unavailable.

Vulnerabilities & RiskHarvest Now, Forge Later (HNFL)Harvest Now, Forge Later (HNFL) is an adversary strategy of collecting signatures and certificates today to forge them once quantum computing derives private keys.Read definition
Vulnerabilities & RiskCWE (Common Weakness Enumeration)A CWE (Common Weakness Enumeration) is a category of underlying software flaw — like buffer overflow or SQL injection — that can lead to vulnerabilities.Read definition
Vulnerabilities & RiskExploit Prediction Scoring System (EPSS)EPSS is a FIRST-maintained probabilistic score estimating the likelihood a CVE will be exploited in the wild within 30 days — prioritizing by real-world risk.Read definition

Hard-Coded Secret

What Is a Hard-Coded Secret?

Related Terms

Related Content