Group
  • Security

    Remove hardcoded secrets from my codebase

    Finds API keys and passwords committed in source, moves them to environment variables, and tells you which ones to rotate.

    • Improve quality
    • Debug & fix
    • Beginner
    • Replit
    • Cursor
    • Bolt
    • Lovable
    • General

Free Prompt

Scan my codebase for hardcoded secrets: API keys, database passwords, private keys, tokens, and connection strings sitting directly in source files. Check config files, source code, seed scripts, and test fixtures. Also check whether my .env file is committed to git. For each secret found: replace the literal value with an environment variable read, add the variable to my .env.example (or create one) with a placeholder value, and make sure my .gitignore excludes real env files. Do not delete or rename any code that uses the secret; only change where the value comes from. Important: any secret that has been committed to a git repository must be treated as compromised. At the end, give me a list of every secret that needs to be rotated (regenerated at the provider) with a link or instructions for where to rotate each one. Do not attempt to rewrite git history yourself; explain the options (rotate, or history rewrite with a tool like git filter-repo) and let me choose. Deliver a table of findings: file, type of secret, what you changed, and whether rotation is required.

What This Does / How This Helps

Finds the keys and passwords pasted straight into your source code, moves them to environment variables, and hands you a rotation list for anything that ever touched a git commit. Hardcoded secrets are a top audit finding in vibe-coded apps. The AI writes a key inline because it's the fastest way to make the demo work, and the key ends up on GitHub where scrapers find it within minutes. People lose entire cloud accounts and rack up huge bills this way. The prompt is careful about the part most fixes skip: moving the value isn't enough if it was ever committed. You get a per-secret rotation list so the old leaked values actually die.

Want to skip doing this by hand?

Fortivibe audits your app for all of the areas these prompts cover (and more).

See What We Check

Related Prompts