---
id: "AE22-015"
category: "security"
confidence: 0.99
date: "2026-02-15"
source_file: "PRODUCTION_HARDENING_PLAN.md (Section 3.6 Secrets Management)"
---

# AE22-015

Hardcoded credentials in source code are the single biggest security risk in a codebase -- move ALL secrets to environment variables with .env for development (gitignored) and GitHub Secrets for CI/CD, with production mode that raises RuntimeError if secrets are missing
