What causes "Hardcoded password detected" in davila7/claude-code-templates?

Replace the literal with an environment variable reference and a key name only, e.g. 'password: use $DB_PASSWORD (set it in your shell)' — but note any non-space token matches, so prefer rephrasing to 'set the DB_PASSWORD env var' with no key:value shape

davila7/claude-code-templates · critical

SEM_E011

SEM_E011

Error message

Hardcoded password detected

What it means

SEM_E011 is a critical finding from checkSensitiveData: the regex /(?:password|passwd|pwd)\s*[:=]\s*[^\s]+/gi matched the component content. The validator refuses content that appears to embed a literal password via key:value or key=value syntax, since components are distributed publicly and any committed credential is compromised.

Source

Thrown at cli-tool/src/validation/validators/SemanticValidator.js:115

      {
        pattern: /output\s+raw\s+(code|text|data)/gi,
        code: 'SEM_W003',
        message: 'Raw output request (potential data exfiltration)',
        severity: 'low'
      },
      {
        pattern: /(repeat|echo)\s+after\s+me/gi,
        code: 'SEM_W004',
        message: 'Repetition instruction (potential prompt leakage)',
        severity: 'low'
      }
    ];

    // Sensitive data patterns
    this.SENSITIVE_DATA_PATTERNS = [
      {
        pattern: /(?:password|passwd|pwd)\s*[:=]\s*[^\s]+/gi,
        code: 'SEM_E011',
        message: 'Hardcoded password detected',
        severity: 'critical'
      },
      {
        pattern: /(?:api[_-]?key|apikey)\s*[:=]\s*['"]?[a-zA-Z0-9]{20,}['"]?/gi,
        code: 'SEM_E012',
        message: 'Hardcoded API key detected',
        severity: 'critical'
      },
      {
        pattern: /(?:secret|token)\s*[:=]\s*['"]?[a-zA-Z0-9]{20,}['"]?/gi,
        code: 'SEM_E013',
        message: 'Hardcoded secret/token detected',
        severity: 'critical'
      }
    ];
  }

View on GitHub (pinned to a0851ed10c)

Solutions

Replace the literal with an environment variable reference and a key name only, e.g. 'password: use $DB_PASSWORD (set it in your shell)' — but note any non-space token matches, so prefer rephrasing to 'set the DB_PASSWORD env var' with no key:value shape
Remove the credential from the markdown entirely and document where to configure it
If a real secret was committed, rotate it immediately — it is compromised

Example fix

# before
password: SuperSecret123
# after
Set the DB_PASSWORD environment variable before running (never inline it).

Defensive patterns

Strategy: validation

Validate before calling

const credRegex = /(?:password|passwd|pwd)\s*[:=]\s*[^\s]+/gi;
const hits = component.content.match(credRegex) ?? [];
const real = hits.filter(h => !/[<>$\{(]|env|placeholder|example/i.test(h));
if (real.length) throw new Error('hardcoded credential');

Try / catch

try { const r = await validator.validate(component); } catch (e) { /* inspect r/finding, strip secret, rotate */ }

Prevention

Never write key:value credentials in markdown; document env var names only
Use secret scanners (gitleaks/trufflehog) in CI
Rotate any credential that ever appears in a file

When it happens

Trigger: validate() where content contains 'password: something', 'passwd=abc', or 'pwd: x' followed by any non-whitespace value. Note the value can be a placeholder like $PASSWORD or '${pwd}' and still match because the regex accepts any non-space token.

Common situations: YAML frontmatter or config examples in agent/command markdown that hardcode 'password: mysecret123'; environment-variable docs like 'password: <your-password-here>' also match since the pattern does not require a quoted literal.

Related errors

AI-assisted analysis of davila7/claude-code-templates@a0851ed10c (2026-08-28). Data as JSON: /api/errors/ae0d529b490e5dee. Report an issue: GitHub.