ai-slop/hardcoded-idmanual fix

Hardcoded ID.

A provider, tenant, or project identifier pasted into source as a string literal: a Stripe price ID, an org ID, an API key. It bakes one environment into the code.

Examples

Flagged shape and clean shape.

Each example shows the exact code shape the rule is looking for, then the smallest version that keeps the intent without hiding risk or adding noise.

hardcoded-id.ts

✗ Flagged

const PRO_PLAN_PRICE_ID = 'price_1PqR8sKx2Lm9TzQa'

export async function startCheckout(customerId: string) {
  return stripe.checkout.sessions.create({
    customer: customerId,
    line_items: [{ price: PRO_PLAN_PRICE_ID, quantity: 1 }],
  })
}

Why this trips

Deterministic line match: on lines that name an ID-like key (`api_key`, `client_id`, `price_id`, `tenant_id`, `token`, `secret`, and similar), flags quoted literals shaped like provider IDs (`price_…`, `cus_…`, `sk_…`), UUIDs, or long mixed-case alphanumeric strings.

hardcoded-id.ts

✓ Clean

const PRO_PLAN_PRICE_ID = config.stripe.proPlanPriceId

export async function startCheckout(customerId: string) {
  return stripe.checkout.sessions.create({
    customer: customerId,
    line_items: [{ price: PRO_PLAN_PRICE_ID, quantity: 1 }],
  })
}

What changed

Move provider IDs, tenant IDs, price IDs, and keys to environment variables or a typed config module.

Why an AI agent produces this

Agents copy IDs from the prompt, a dashboard, or a log straight into code to get a working example. The literal then ships to every environment.

Provenance

How this rule is justified.

Rule id

ai-slop/hardcoded-id

Enforcing engine

ai-slop

Detector strategy

Legitimate code that is NOT flagged

Lines that read from the environment (`process.env`, `os.environ`, `getenv`), placeholders such as `changeme` or `your_…`, env-var names, readable slugs, documentation contexts, comments, migrations, and non-production paths are not flagged.

Evidence

Introduced in aislop v0.9.5 alongside hardcoded-url; v0.9.6 stopped flagging env-var names, readable slugs, and migration files.

← All patterns Run the local CLI →