Magebean Logo Magebean
← Back to Baseline

MB-R097

AUTOMATED Secrets are not hardcoded in custom code

MB-C03 Secure Coding Practices High

No hardcoded secrets detected in custom code paths.

Why it Matters

Hardcoded secrets in PHP, XML, JavaScript, templates, or sample files are easy to leak through Git, build artifacts, screenshots, or error output. They are also difficult to rotate because the value is mixed into application code.

Secrets should be provided through environment configuration or a secret manager so access is limited, rotation is practical, and code can be shared safely.

Verification Steps

Code scan

grep -RIE "(sk_live_|api_key|secret|password|private_key|token)" app/code app/design config 2>/dev/null

Repository scan

# Use a secret scanner when available
git secrets --scan
trufflehog filesystem .

Remediation / Fix Guidance

  1. Move API keys, passwords, and tokens out of code and into env.php, environment variables, or a secret manager.
  2. Rotate any secret that was hardcoded or committed.
  3. Add secret scanning to CI.
  4. Use least-privilege credentials for each integration.
  5. Keep sample config values fake and clearly non-production.

Examples

Fail Example
private $apiKey = "sk_live_real_secret";
# Secret hardcoded in module → FAIL
Pass Example
$apiKey = $this->scopeConfig->getValue("payment/provider/api_key");
# Secret sourced from protected config/secret storage → PASS

References