Rationale

Hardcoded secrets (API keys, passwords, tokens) are a top security risk. GitLab enforces Secret Detection with Push Protection to block commits containing secrets before they reach the repository.

Enforcement

• SpotBugs: Custom detector for String literals matching secret patterns
• SonarQube: Security hotspot rules for hardcoded credentials

Requirements

1. No hardcoded API keys, passwords, tokens, or connection strings in source code
2. Secrets must be loaded from environment variables, secret managers (e.g. Vault), or encrypted config
3. Pre-commit hooks should scan for secrets before commit
4. CI pipeline must run secret detection on every push

Detection Patterns

(?i)(password|secret|api[_-]?key|token|private[_-]?key)\s*[=:]\s*['"][^'"]+['"]

References

• GitLab Secret Detection: https://handbook.gitlab.com/handbook/security/product-security/secret-detection/
• Secret Push Protection: https://handbook.gitlab.com/handbook/security/product-security/secret-detection/secret-push-protection/