content: |
  # No Hardcoded Secrets

  Never hardcode secrets, API keys, passwords, or tokens in source code.

  - Use environment variables or secrets managers
  - Never commit `.env` files with real credentials
  - No credentials in URLs, logs, or error messages
  - Use placeholder values in examples and tests

metadata:
  enforce: hard
  reason: "Blocked by security-baseline: no hardcoded secrets or credentials"
  matches:
    - tool: write_file
      pattern: "\\.env(\\n|$)"
    - tool: edit_file
      pattern: "\\.env(\\n|$)"
    - tool: write_file
      pattern: "(api_key|secret_key|password|token)\\s*=\\s*[\"'][^\"']{8,}"
    - tool: edit_file
      pattern: "(api_key|secret_key|password|token)\\s*=\\s*[\"'][^\"']{8,}"
