Keep API keys, tokens, and credentials out of source; load them from environment variables or a managed secret store.
Why This Matters
Secrets committed to code leak through repos, logs, and bundles, granting attackers direct access (OWASP A05/A07).
Related Rules
Catch this automatically on every PR
BeforeMerge scans your pull requests against this rule and dozens more. Get actionable feedback before code ships.