Hardcoded Credentials in Laravel: How to Find and Remove Secrets from Source Code

The Problem

How to Fix

1. 1

   Find hardcoded secrets in your codebase

   Search for common patterns:

   grep -rn 'password.*=.*["'\']' app/ config/ --include='*.php'
   grep -rn 'api_key\|api_secret\|secret_key\|access_token' app/ --include='*.php'
   grep -rn 'sk_live\|pk_live\|sk_test\|AKIA' app/ config/ --include='*.php'

   Also check for base64-encoded keys and connection strings with embedded credentials.

2. 2

   Move secrets to .env and config files

   Replace hardcoded values with environment variable references:

   // BEFORE — hardcoded in a service class
   $client = new StripeClient('sk_live_abc123');

   // AFTER — from environment
   $client = new StripeClient(config('services.stripe.secret'));

   // config/services.php
   'stripe' => [
       'secret' => env('STRIPE_SECRET'),
   ],

   // .env
   STRIPE_SECRET=sk_live_abc123

   Never commit .env to version control. Ensure .env is in your .gitignore.

3. 3

   Rotate any exposed credentials immediately

   If credentials were ever committed to Git, they are compromised even if the commit is deleted:

   1. Regenerate every exposed API key, password, and secret
   2. Update the new values in your production .env
   3. Revoke the old credentials at the provider (Stripe, AWS, etc.)
   4. Check Git history: git log --all -p -S 'sk_live' to find exposure
   5. Consider using git-filter-repo to remove secrets from history if the repo is public

4. 4

   Add secret scanning to your workflow

   Prevent future commits of secrets:

   # Install gitleaks as a pre-commit hook
   brew install gitleaks
   gitleaks detect --source . --verbose

   # Or use GitHub's built-in secret scanning
   # Enable in repo Settings > Code security and analysis > Secret scanning

   GitHub will alert you immediately if a known secret pattern is pushed to the repo.

How to Verify

php artisan stackshield:scan --check=SS008

grep -rn 'password\|secret\|api_key' app/ config/ routes/ --include='*.php' | grep -v 'env(\|config(\|#\|//'

Prevention

Frequently Asked Questions