Use of Hard-coded Credentials

Property
Language	regex
Severity
CWE	CWE-798: Use of Hard-coded Credentials
OWASP	A07:2021 - Identification and Authentication Failures
Confidence Level	Low
Impact Level	Medium
Likelihood Level	Low

Description#

Sensitive Infracost API tokens have been found hard-coded in the source code. Storing credentials directly in code exposes them to anyone with access to the repository, increasing the risk of leaks.

Impact#

If attackers obtain these API tokens, they could access or manipulate your Infracost account, potentially leading to unauthorized usage, data exposure, or financial loss. Hard-coded secrets also increase the risk of accidental leaks through code sharing or public repositories.