E11080: hardcoded cloud provider credential detected

What went wrong

A string literal matching a known cloud provider credential pattern was found in source code. Detected patterns include AWS access keys (AKIA, AGPA, AIDA, AROA, AIPA, ANPA, ANVA, ASIA prefixes), GCP API keys (AIza prefix), GCP OAuth Client IDs, and Azure Storage credentials.

This is a critical security vulnerability (CWE-798) — anyone with access to your source code, version control history, build logs, or compiled artifacts can extract this credential.

Worked examples

Compilable examples demonstrating this error and the correct fix:

ek9 -q 704 (How does EK9 detect hardcoded secrets at compile time?)
ek9 -q 702 (How do I load secrets from environment variables in EK9?)
ek9 -q 706 (How do I use credentials, URLs, usernames and passwords o...)

Rationale

GitGuardian (2025): 23.8 million new secrets exposed in public GitHub repos in 2024 alone. IBM (2024): Average breach cost for stolen credentials is $4.81M. Verizon DBIR (2023): stolen credentials were used in 49% of breaches by external actors.

EK9 eliminates this entire bug category at compile time. No other language prevents hardcoded cloud credentials from compiling.

How to fix it

Load the credential from an environment variable using the Sensitive type, and use the Sensitive value directly - it auto-redacts on display:

secret <- EnvVars().sensitiveGet("AWS_ACCESS_KEY_ID")
if secret?
  configureService(secret)

For local development, set the environment variable:

export AWS_ACCESS_KEY_ID=AKIA...

For production, use your cloud provider's secrets manager (AWS Secrets Manager, GCP Secret Manager, Azure Key Vault).

Examples

Every example is compiled by the EK9 compiler: the first fails exactly as captioned, the others fix it.

Fails with E11080: hardcoded cloud provider credential detected

#!ek9
defines module error.e11080.bad

  defines function

    <?-
      AWS IAM User Access Key (AKIA prefix).
    -?>
    testAwsIamUserKey()
      key <- "AKIAIOSFODNN7EXAMPLE1"

      stdout <- Stdout()
      stdout.println(key)

    <?-
      AWS STS Temporary Session Key (ASIA prefix).
    -?>
    testAwsSessionKey()
      key <- "ASIAISAMPLEKEYID12345"

      stdout <- Stdout()
      stdout.println(key)

    <?-
      AWS Group Access Key (AGPA prefix).
    -?>
    testAwsGroupKey()
      key <- "AGPAFAKEEXAMPLE123456"

      stdout <- Stdout()
      stdout.println(key)

    <?-
      AWS Instance Profile Access Key (AIPA prefix).
    -?>
    testAwsInstanceProfileKey()
      key <- "AIPAFAKEEXAMPLE123456"

      stdout <- Stdout()
      stdout.println(key)

    <?-
      AWS Role Access Key (AROA prefix).
    -?>
    testAwsRoleKey()
      key <- "AROAFAKEEXAMPLE123456"

      stdout <- Stdout()
      stdout.println(key)

    <?-
      AWS A3T variant Access Key.
    -?>
    testAwsA3tKey()
      key <- "A3T0FAKEEXAMPLE12345"

      stdout <- Stdout()
      stdout.println(key)

    <?-
      GCP API Key (AIza prefix).
    -?>
    testGcpApiKey()
      key <- "AIzaSyC_abcDEFghijKLMNOpqrstuvwxyz123456"

      stdout <- Stdout()
      stdout.println(key)

    <?-
      GCP OAuth Client ID.
    -?>
    testGcpOAuthClientId()
      key <- "123456789012-abcdefghijklmnopqrstuvwxyz012345.apps.googleusercontent.com"

      stdout <- Stdout()
      stdout.println(key)

    <?-
      Azure Storage Connection String.
    -?>
    testAzureConnectionString()
      key <- "DefaultEndpointsProtocol=https;AccountName=mystorageacct;AccountKey=abc123"

      stdout <- Stdout()
      stdout.println(key)

    <?-
      Azure Storage Account Key.
    -?>
    testAzureAccountKey()
      key <- "AccountKey=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVab=="

      stdout <- Stdout()
      stdout.println(key)

Fixed: Read the credential from the environment as a Sensitive

#!ek9
defines module error.e11080.good

  defines function

    configureService()
      -> credential as Sensitive
      stdout <- Stdout()
      stdout.println($(credential?))

    demo()
      secret <- EnvVars().sensitiveGet("AWS_ACCESS_KEY_ID")
      if secret?
        configureService(secret)

Questions and answers

These Q&A entries show E11080 and its fix: