SG-014: Hardcoded Secret Candidate

Severity: LOW

API key patterns (sk-, ghp_, AKIA, etc.) in file content

Fires when

• A string matching a real API-key/token shape appears in the file (OpenAI/Anthropic sk-, GitHub ghp_/gho_, AWS AKIA, GitLab glpat-, Slack xox*, Google AIza, SendGrid SG., Mailchimp, Square).
• A hardcoded password, secret, api_key, or access_token is assigned an 8+ character quoted value.
• The rule only fires when the matched value fits a believable real-token shape (length/charset) AND is not a placeholder - insert_api_key, your-api-key, AWS docs samples, and template vars are filtered out.

Remediation

No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.