E11081: hardcoded platform token detected

What went wrong

A string literal matching a known platform token pattern was found in source code. Detected patterns include GitHub tokens (ghp_, gho_, ghs_, ghu_, ghr_, github_pat_), GitLab tokens (glpat-, gldt-, glrt-, and 9 more formats), Slack tokens (xoxb-, xoxp-, xapp-, and 5 more formats), npm tokens (npm_), PyPI tokens, RubyGems tokens, Shopify tokens, Heroku API keys, Facebook tokens, and Microsoft Teams webhook URLs.

Platform tokens grant access to repositories, CI/CD pipelines, messaging systems, and package registries. A leaked token can enable supply chain attacks, data exfiltration, and lateral movement.

Worked examples

Compilable examples demonstrating this error and the correct fix:

ek9 -q 704 (How does EK9 detect hardcoded secrets at compile time?)
ek9 -q 702 (How do I load secrets from environment variables in EK9?)

Rationale

Secret scanning (GitHub's, for one) can report a token after it is pushed, but by then it has already been exposed to everyone who can read the repository, and once committed it persists in git history indefinitely.

EK9 prevents the token from entering source code in the first place.

How to fix it

Load the token from an environment variable:

secret <- EnvVars().sensitiveGet("GITHUB_TOKEN")
if secret?
  configureService(secret)

For CI/CD environments, use the platform's native secrets mechanism:

GitHub Actions: secrets.GITHUB_TOKEN
GitLab CI: CI/CD Variables (masked)
Slack: App configuration portal

Never commit tokens to version control, even in private repos.

Examples

Every example is compiled by the EK9 compiler: the first fails exactly as captioned, the others fix it.

Fails with E11081: hardcoded platform token detected

#!ek9
defines module error.e11081.bad

  defines function

    demo()
      stdout <- Stdout()
      token <- "ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghij"
      stdout.println(token)

Fixed: Read the token from the environment as a Sensitive

#!ek9
defines module error.e11081.good

  defines function

    configureService()
      -> token as Sensitive
      stdout <- Stdout()
      stdout.println($(token?))

    demo()
      secret <- EnvVars().sensitiveGet("GITHUB_TOKEN")
      if secret?
        configureService(secret)

Questions and answers

These Q&A entries show E11081 and its fix: