id: JS-SEC-004
name: hardcoded-secrets
severity: high
language: javascript
cwe: CWE-798
owasp: "A07:2021"
description: "Detect hardcoded API keys, passwords, tokens, and other sensitive credentials in source code."
pattern:
  type: regex
  regex:
    - "(?i)(password|passwd|secret|api_key|apikey|token|auth_token)\\s*[:=]\\s*[\"'][^\"']+[\"']"
    - "(?i)(aws_access_key|aws_secret)\\s*[:=]\\s*[\"']"
message: "Potential hardcoded secret detected. Storing credentials in source code exposes sensitive data."
fix_hint: "Use environment variables or a secrets management service to store sensitive credentials."
references:
  - "https://cwe.mitre.org/data/definitions/798.html"
  - "https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/"
