id: no-hardcoded-secret
language: rust
severity: error
category: security
message: "Hardcoded secret in source code. Use environment variables or a vault."
note: "Secrets in source code end up in version control and logs."
rule:
kind: let_declaration
regex: 'let\s+(mut\s+)?\w*(api_key|secret|password|token|credential|auth_token|webhook_secret|signing_key|private_key|access_key|secret_key|api_secret|client_secret|encryption_key)\s*(:\s*[^=]+)?\s*=\s*"'
ignores:
- "**/tests/**"
- "**/*_tests/**"
- "**/*_test/**"
- "**/test_*"
- "**/*_test.rs"
- "**/examples/**"
- "**/fixtures/**"
skip_test_code: true
tests:
should_match:
- 'let api_key = "sk-abc123456";'
- 'let password = "hunter2";'
should_not_match:
- 'let api_key = std::env::var("API_KEY")?;'
- 'let name = "John";'