Find hardcoded secrets in code

Detect hardcoded sensitive data in code

Finding exposed API keys, credentials, and tokens that code review and linters miss

• · Codebase under analysis
• · sast/architecture.md (prerequisite)

• · sast/hardcodedsecrets-results.md with findings
• · API keys, passwords, tokens consolidated

• · sast/architecture.md must exist
• · Source code accessible for scanning

• · Obfuscated secrets bypass string matching
• · Entropy thresholds miss weak passwords
• · False positives on test fixtures and examples

• · Batched verify approach finds secrets across codebase
• · Distinguishes real secrets from test data
• · Consolidates findings into actionable report