← VCE Software Development U4O2

Hard-coded API keys and secrets

A key, password or token written directly into source code. Anyone who can read the code or its repository can steal it, and deleting the file later does not remove it from the history.

Part of: VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 26, ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 64, WA Computer Science ATAR Year 11 — Cyber Security — Module 177

Understanding Hard-coded API keys and secrets in VCE Software Development U4O2

What it does: This removes the file only from the latest version. Earlier commits still contain the key, so anyone can view the history and recover it. A password written as a string in source code is committed with the code, so everyone who can read the repository can see and steal it. Putting the key in a variable does not hide it. Anyone who can read app.py can read the key, so it is a hard-coded secret. Threat actors run automated tools that scan public repositories for leaked keys. A leaked key can be used within minutes of being pushed. Once a secret has been exposed it must be treated as compromised. Only revoking it and issuing a new one stops it being misused.

Common mistakes: The API key is typed straight into the source code, so anyone who can read the code or its repository can steal it. It should be read from an environment variable: key = os.environ["API_KEY"]. Automated bots constantly scan public repositories for leaked keys, often within minutes of a push. The line should say that bots scan public code for keys.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Hard-coded API keys and secrets to a class →

This module's key terms are also in a printable crossword (Modules 23–47) and word search (Modules 1–47).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
A developer writes API_KEY = "sk_live_83hd92" directly in app.py. Is this a hard-coded secret?
Yes, the key is written directly in the source codeNo, it is safe because it is inside a variable
Matches
token = "ghp_a8Kd92Lx" # remove before pushing later
↓
The token is hard-coded in the source file and relying on remembering to remove it later is unsafe. Once committed or pushed, it stays in the history and can be stolen.
Applying
Meanings
Term
hard-coded secret
Meaning
A key, password or token written directly into source code. Anyone who can read the code or its repository can steal it, and deleting the file later does not remove it from the history.
Practice
// BAD: secret is hard-coded in source code
Testing
Gaps
const = "skliveabc123";
Check Answer
Spots
1import os
2key = "sk_live_51Hx8d2"

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Snowy Owl' badge — List Slicer, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A developer writes API_KEY = "sk_live_83hd92" directly in app.py. Is this a hard-coded secret?
A. Yes, the key is written directly in the source code ✓
B. No, it is safe because it is inside a variable
Putting the key in a variable does not hide it. Anyone who can read app.py can read the key, so it is a hard-coded secret.
2. A student commits config.py containing a database password to a repository. Who can steal the password?
A. Anyone who can read the repository ✓
B. Only the developer who wrote the file
A committed secret is visible to everyone with access to the repository, including other team members and anyone outside the team if the repository is public.
3. A developer pushes code with a hard-coded API key to a public repository. What is the risk?
A. The key is hidden because the code is compiled later
B. Strangers can find and use the key, for example by scanning public code ✓
Threat actors run automated tools that scan public repositories for leaked keys. A leaked key can be used within minutes of being pushed.
4. You notice a key was committed by mistake and you delete the file in your next commit. Is the key now safe?
A. No, the key still exists in the commit history ✓
B. Yes, deleting the file removes the key everywhere
Version control keeps every earlier commit. Anyone can view the old version of the file, so the key must be revoked and replaced.
5. A key was exposed in a repository's history. What should the team do first?
A. Delete the file and keep using the same key
B. Revoke the key and issue a new one ✓
Once a secret has been exposed it must be treated as compromised. Only revoking it and issuing a new one stops it being misused.

Match the Pairs

API_KEY = "sk_live_51Hx9Zq" → A hard-coded secret: a live API key typed straight into the source code, where anyone who can read the code can copy it
git push origin main → Publishes commits to a remote repository, so any key committed earlier is now visible to everyone with access to that repository
Deleting a file that contains a key in a later commit is not enough, because the old commit history still holds the key → git rm config.py && git commit -m "remove key"
A password committed to a repository can be stolen by anyone who can read it, including the public if the repository is public → db_password = "Summer2024!"
token = "ghp_a8Kd92Lx" # remove before pushing later → The token is hard-coded in the source file and relying on remembering to remove it later is unsafe. Once committed or pushed, it stays in the history and can be stolen.
git rm secrets.txt git commit -m "deleted keys" → Deleting the file in a new commit does not remove the keys from earlier commits, so a leaked key can still be found in the history and must be revoked.

Key Term

hard-coded secret
A key, password or token written directly into source code. Anyone who can read the code or its repository can steal it, and deleting the file later does not remove it from the history.

Fill in the Blanks

1. const apiKey = "sk_live_abc123"; fetch(url + "?key=" + apiKey);
Hint: Type the variable name that holds the hard-coded key. It is used again on the next line.
2. git add config.py git commit -m "Add API key"
Hint: Type the git command that saves the staged file, key included, as a snapshot in the repository history.
3. # Public repo: key is now visible git push origin main
Hint: Type the git command that uploads local commits to the remote repository, where others can read them.
4. git rm config.py git commit -m "Remove key" git log -p
Hint: Type the git subcommand that lists past commits with their changes. The deleted key still shows up there.
5. echo "config.py" >> .gitignore
Hint: Type the name of the special file that tells git which files never to track or commit.

Spot the Error

Question 1
A import os
B key = "sk_live_51Hx8d2"
C url = "https://api.site.com"
D print("Calling API")
Line B — The API key is typed straight into the source code, so anyone who can read the code or its repository can steal it. It should be read from an environment variable: key = os.environ["API_KEY"].
Question 2
A Dev pushes app.py with key
B Nobody reads public code
C Attacker copies the key
D Attacker runs up your bill
Line B — Automated bots constantly scan public repositories for leaked keys, often within minutes of a push. The line should say that bots scan public code for keys.
Question 3
A const pw = "Pa55word!";
B const user = "app_user";
C connect(user, pw);
Line A — The database password is hard-coded in the source file, so anyone who can read the code can see it. It should be loaded from the environment: const pw = process.env.DB_PW;
Question 4
A import os
B # TODO remove key sk_live_8f2a
C key = os.environ["API_KEY"]
D print("Key loaded")
Line B — A comment is still part of the source code. Anyone reading the file or the repository can see the key written in it. The comment should not contain the secret, for example: # Key is read from env var.
Question 5
A # .env
B *.pem
C secrets.json
Line A — In a .gitignore file, a leading # turns the line into a comment, so .env is no longer ignored. The secrets file could then be committed to the repository. The line should be .env.

Student with a class code? Join your class →