What causes "Hardcoded API key detected" in davila7/claude-code-templates?

Replace the key with an env-var reference: 'api_key: $MY_API_KEY' or instruct 'set API_KEY in your environment'

davila7/claude-code-templates · critical

SEM_E012

SEM_E012

Error message

Hardcoded API key detected

What it means

SEM_E012 is a critical finding from checkSensitiveData: /(?:api[_-]?key|apikey)\s*[:=]\s*['"]?[a-zA-Z0-9]{20,}['"]?/gi matched. It detects an api-key assignment whose value is at least 20 alphanumeric characters — the shape of a real key (e.g. a 32-char OpenAI-style key) rather than a placeholder word.

Source

Thrown at cli-tool/src/validation/validators/SemanticValidator.js:121

      {
        pattern: /(repeat|echo)\s+after\s+me/gi,
        code: 'SEM_W004',
        message: 'Repetition instruction (potential prompt leakage)',
        severity: 'low'
      }
    ];

    // Sensitive data patterns
    this.SENSITIVE_DATA_PATTERNS = [
      {
        pattern: /(?:password|passwd|pwd)\s*[:=]\s*[^\s]+/gi,
        code: 'SEM_E011',
        message: 'Hardcoded password detected',
        severity: 'critical'
      },
      {
        pattern: /(?:api[_-]?key|apikey)\s*[:=]\s*['"]?[a-zA-Z0-9]{20,}['"]?/gi,
        code: 'SEM_E012',
        message: 'Hardcoded API key detected',
        severity: 'critical'
      },
      {
        pattern: /(?:secret|token)\s*[:=]\s*['"]?[a-zA-Z0-9]{20,}['"]?/gi,
        code: 'SEM_E013',
        message: 'Hardcoded secret/token detected',
        severity: 'critical'
      }
    ];
  }

  /**
   * Validate component semantics and content
   * @param {object} component - Component data
   * @param {string} component.content - Raw markdown content
   * @param {string} component.path - File path
   * @param {string} component.type - Component type

View on GitHub (pinned to a0851ed10c)

Solutions

Replace the key with an env-var reference: 'api_key: $MY_API_KEY' or instruct 'set API_KEY in your environment'
Rotate the exposed key immediately if it was real
Use placeholder values under 20 chars or with non-alphanumeric characters, e.g. 'api_key: <your-key>'

Example fix

# before
api_key: AIzaSyA1b2C3d4E5f6G7h8I9j0
# after
api_key: $GOOGLE_API_KEY   # set in .env, never commit

Defensive patterns

Strategy: validation

Validate before calling

const keyRegex = /(?:api[_-]?key|apikey)\s*[:=]\s*['"]?[a-zA-Z0-9]{20,}['"]?/gi;
if (keyRegex.test(component.content)) { /* replace with $ENV ref */ }

Prevention

Reference environment variables instead of literal keys
Use placeholders with non-alphanumeric chars (<your-key>)
Rotate exposed keys immediately

When it happens

Trigger: validate() on content containing 'api_key: sk1234567890abcdefghij', 'apiKey=AbCdEf...20+chars', etc. Values shorter than 20 chars, containing dashes/underscores, or referencing env vars do not match.

Common situations: MCP server configuration examples in component markdown that paste a real key instead of process.env / $API_KEY; docs showing truncated example keys of 20+ alphanumeric chars.

Related errors

AI-assisted analysis of davila7/claude-code-templates@a0851ed10c (2026-08-28). Data as JSON: /api/errors/9a40817fd9c78434. Report an issue: GitHub.