SG-071: Hardcoded Provider Secret in Config

Severity: CRITICAL

Hardcoded API keys / tokens / passwords / connection URIs in agent and MCP config files. Covers Supabase (sbp_, JWT), Postgres/MySQL/MongoDB/Redis URIs with embedded password, Tavily / Firecrawl / Brave / Context7 / ref-tools / TestSprite / OpenRouter branded keys, Pipedream MCP UUID endpoints, and JSON/env-line patterns where a sensitive-named key holds a high-entropy value.

Fires when

• Vendor-specific secret: Supabase sbp_, Tavily tvly-, Firecrawl fc-, Brave BSA, OpenAI service key, Pipedream UUID, Cloudflare R2 URL
• Database connection URI with embedded password (Postgres, MySQL, MongoDB, Redis)
• Sensitive key (API_KEY, TOKEN, SECRET, PASSWORD) holds high-entropy value in JSON or env-line format

Remediation

1) Assume the secret is compromised — rotate it with the provider (Anthropic, OpenAI, AWS, GitHub, etc.) before anything else. 2) Remove the literal value from the config file. 3) Move the secret to an environment variable or your secret manager, then reference it from the config via env interpolation. 4) Rewrite git history to scrub the secret from prior commits.