Checks · SEC-008

SEC-008 · Hard-coded admin email or password

Why it matters

A password written in source is shared with everyone who can read the code.

How we detect it

Custom rules look for admin credentials assigned in source.

How we fix it

Read the admin list from the environment and check it on the server.

Can it be fixed automatically? With review

Related checks

• AUTH-001 · Admin route without auth check
• AUTH-002 · Authorization by client-side flag only
• AUTH-003 · Supabase user_metadata used for roles
• AUTH-004 · Email confirmation disabled with paid features