A demo login shipped with a casino lobby, an AES key left in a mobile bundle, a database password in a config. Hardcoded secrets are the shortest route to a breach.
A hardcoded credential needs no vulnerability to exploit — the attacker just logs in. It is the one finding that skips the entire kill chain and drops straight into an authenticated session: a production lobby with a demo admin, a bundle with a decryptable AES key, a config with a database password.
We have found a live casino lobby opened by a demo login with a seven-figure test balance — the kind of thing that takes one leaked string to turn into a headline.
Secrets hide in git history, in minified bundles, in an old config nobody reads. A grep for 'password' finds the obvious ones; the real ones are obfuscated, split across files, or tucked into a binary you never decompile.
Both. We scan the full surface, then verify each candidate against the live system so the report contains only working credentials, not noise.
Only the ones you authorise us to assess, under NDA. Findings are reported as what was exposed, with rotation steps — never stored beyond the report.