A hard-coded secret is a password, token, API key, or cryptographic key written directly into software instead of being generated and stored in a protected secret store. It may be buried in source code, a compiled binary, or a default configuration file. Because the value is fixed, anyone who extracts the code, dumps memory, or reverse-engineers the application can recover it.
In cyber security, hard-coded secrets are dangerous because they collapse the trust model: one leaked secret can expose many systems, especially when the same value is reused across installations. Attackers often search for embedded JWT signing keys, database credentials, or cloud access keys to forge tokens, log in as privileged users, or reach management functions. Defenders reduce this risk by generating unique secrets per deployment, storing them in a vault or hardware-backed service, rotating them regularly, and invalidating old tokens and credentials after a fix.