> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flintai.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Hardcoded credentials in agents

> API keys, tokens, or passwords hardcoded in agent source or config files

API keys, tokens, or passwords hardcoded in agent source or config files

## How to resolve

Load credentials from environment variables or a secrets manager (e.g., AWS Secrets Manager, HashiCorp Vault). Never store API keys, tokens, or passwords in source code.

## Risk

**Governance/Compliance**

This vulnerability falls under [ASI03:2026 — Identity and Privilege Abuse](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/) in the OWASP Top 10 for Agentic Applications. Agents inherit, reuse, or escalate identities and credentials beyond their functional scope.

**Security**

API keys, tokens, or passwords hardcoded in agent source or config files. If exploited, this can compromise the agent's integrity, confidentiality, or availability, potentially affecting downstream systems and data.

## Explanation

API keys, tokens, or passwords hardcoded in agent source or config files. This falls under ASI03 (Identity and Privilege Abuse): Agents inherit, reuse, or escalate identities and credentials beyond their functional scope.

## Specifications

**Trigger**

* Agent scan detects aPI keys, tokens, or passwords hardcoded in agent source or config files

The scanner looks for patterns such as:

* api\_key= literal string assignment
* OPENAI\_API\_KEY = '...' hardcoded
* sk- prefix in source file
* password or secret literal in config

**Severity**

* CRITICAL

**Applies to**: Agent