{"record":{"id":"9a40817fd9c78434","repo":"davila7/claude-code-templates","slug":"sem-e012","errorCode":"SEM_E012","errorMessage":"Hardcoded API key detected","messagePattern":"Hardcoded API key detected","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"cli-tool/src/validation/validators/SemanticValidator.js","lineNumber":121,"sourceCode":"      {\n        pattern: /(repeat|echo)\\s+after\\s+me/gi,\n        code: 'SEM_W004',\n        message: 'Repetition instruction (potential prompt leakage)',\n        severity: 'low'\n      }\n    ];\n\n    // Sensitive data patterns\n    this.SENSITIVE_DATA_PATTERNS = [\n      {\n        pattern: /(?:password|passwd|pwd)\\s*[:=]\\s*[^\\s]+/gi,\n        code: 'SEM_E011',\n        message: 'Hardcoded password detected',\n        severity: 'critical'\n      },\n      {\n        pattern: /(?:api[_-]?key|apikey)\\s*[:=]\\s*['\"]?[a-zA-Z0-9]{20,}['\"]?/gi,\n        code: 'SEM_E012',\n        message: 'Hardcoded API key detected',\n        severity: 'critical'\n      },\n      {\n        pattern: /(?:secret|token)\\s*[:=]\\s*['\"]?[a-zA-Z0-9]{20,}['\"]?/gi,\n        code: 'SEM_E013',\n        message: 'Hardcoded secret/token detected',\n        severity: 'critical'\n      }\n    ];\n  }\n\n  /**\n   * Validate component semantics and content\n   * @param {object} component - Component data\n   * @param {string} component.content - Raw markdown content\n   * @param {string} component.path - File path\n   * @param {string} component.type - Component type","sourceCodeStart":103,"sourceCodeEnd":139,"githubUrl":"https://github.com/davila7/claude-code-templates/blob/a0851ed10c7c60463dac8cfaaca124cf32d5804d/cli-tool/src/validation/validators/SemanticValidator.js#L103-L139","documentation":"SEM_E012 is a critical finding from checkSensitiveData: /(?:api[_-]?key|apikey)\\s*[:=]\\s*['\"]?[a-zA-Z0-9]{20,}['\"]?/gi matched. It detects an api-key assignment whose value is at least 20 alphanumeric characters — the shape of a real key (e.g. a 32-char OpenAI-style key) rather than a placeholder word.","triggerScenarios":"validate() on content containing 'api_key: sk1234567890abcdefghij', 'apiKey=AbCdEf...20+chars', etc. Values shorter than 20 chars, containing dashes/underscores, or referencing env vars do not match.","commonSituations":"MCP server configuration examples in component markdown that paste a real key instead of process.env / $API_KEY; docs showing truncated example keys of 20+ alphanumeric chars.","solutions":["Replace the key with an env-var reference: 'api_key: $MY_API_KEY' or instruct 'set API_KEY in your environment'","Rotate the exposed key immediately if it was real","Use placeholder values under 20 chars or with non-alphanumeric characters, e.g. 'api_key: <your-key>'"],"exampleFix":"# before\napi_key: AIzaSyA1b2C3d4E5f6G7h8I9j0\n# after\napi_key: $GOOGLE_API_KEY   # set in .env, never commit","handlingStrategy":"validation","validationCode":"const keyRegex = /(?:api[_-]?key|apikey)\\s*[:=]\\s*['\"]?[a-zA-Z0-9]{20,}['\"]?/gi;\nif (keyRegex.test(component.content)) { /* replace with $ENV ref */ }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Reference environment variables instead of literal keys","Use placeholders with non-alphanumeric chars (<your-key>)","Rotate exposed keys immediately"],"tags":["hardcoded-credentials","api-key","security"],"backgroundTag":"hardcoded-secret-detected","analyzedSha":"a0851ed10c7c60463dac8cfaaca124cf32d5804d","analyzedAt":"2026-08-28T14:11:56.058Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}