Usage of hard-coded secret

Rule ID: javascript_express_hardcoded_secret
Languages: javascript
Source: <a class="text-main dark:text-main-300 hover:underline" href="https://github.com/bearer/bearer-rules/blob/main/rules/javascript/express/hardcoded_secret.yml">hardcoded_secret.yml

Description

Storing secrets directly in code compromises security. It's safer to use environment variables or a secret management system.

Do not store plaintext secrets in your code. This makes your application vulnerable to unauthorized access if the codebase is exposed.
```
app.use(
  session({
    secret: "shh-my-secret",
    name: "my-custom-session-name",
  })
)
```
Do use environment variables to store secrets. This method keeps sensitive information out of your codebase.
```
app.use(
  session({
    secret: process.env.SECRET,
    name: "my-custom-session-name",
  })
)
```
Do use a secret management system or a key management service (KMS) with encryption for enhanced security. These services provide secure storage and management of secrets, reducing the risk of exposure.

To skip this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --skip-rule=javascript_express_hardcoded_secret

To run only this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --only-rule=javascript_express_hardcoded_secret