E11086: hardcoded API key detected

Category: E11xxx Code quality and IR analysis · Reported in phase: PRE_IR_CHECKS · Classification: HARDCODED_SECRET_API_KEY · All error codes

What went wrong

A string literal matching a known API key pattern was found in source code. Detected patterns include keys from payment providers (Stripe, Square, Flutterwave), AI platforms (Anthropic, OpenAI, HuggingFace), infrastructure services (Vault, Terraform, DigitalOcean, Databricks, PlanetScale, Pulumi), communication platforms (SendGrid, Twilio), developer tools (Artifactory, Linear, Notion, Postman), security services (Sentry, Grafana, Cloudflare), and others (1Password, Age, SettleMint, Adobe, ClickHouse).

API keys often have broad permissions and can incur financial charges, access sensitive data, or modify infrastructure when misused.

Worked examples

Compilable examples demonstrating this error and the correct fix:

  • ek9 -q 704 (How does EK9 detect hardcoded secrets at compile time?)

Rationale

Stripe reports that exposed test keys (sk_test_) are used in credential stuffing attacks to probe for live keys with the same structure. Even test/development keys should not be in source code — they reveal your account structure and can be escalated.

AI platform keys (Anthropic, OpenAI) can incur significant usage charges if leaked. Infrastructure keys can modify or destroy cloud resources.

How to fix it

Load the API key from an environment variable:

secret <- EnvVars().sensitiveGet("PAYMENT_API_KEY")
if secret?
  configureService(secret)

For different environments, use environment-specific variables:

  • Development: STRIPE_SECRET_KEY=sk_test_...
  • Staging: STRIPE_SECRET_KEY=sk_test_...
  • Production: STRIPE_SECRET_KEY=sk_live_...

Use your deployment platform's secrets management:

  • Docker: --env-file or secrets
  • Kubernetes: Secrets or external-secrets operator
  • Cloud: AWS Secrets Manager, GCP Secret Manager, Azure Key Vault

See also

  • E11080: hardcoded cloud provider credential detected
  • E11081: hardcoded platform token detected
  • E11082: hardcoded private key material detected
  • E11083: hardcoded database credential detected
  • E11084: hardcoded JWT token detected

Examples

Every example is compiled by the EK9 compiler: the first fails exactly as captioned, the others fix it.

Fails with E11086: hardcoded API key detected

#!ek9
defines module error.e11086.bad

  defines function

    demo()
      stdout <- Stdout()
      key <- "sk_live_abcdefghijklmnopqrstuvwxyz"
      stdout.println(key)

Fixed: Read the API key from the environment as a Sensitive

#!ek9
defines module error.e11086.good

  defines function

    configureService()
      -> apiKey as Sensitive
      stdout <- Stdout()
      stdout.println($(apiKey?))

    demo()
      secret <- EnvVars().sensitiveGet("PAYMENT_API_KEY")
      if secret?
        configureService(secret)

Questions and answers

These Q&A entries show E11086 and its fix: