# Finding and fixing exposed hardcoded secrets in your GitHub project with Snyk

DevFeed: [Finding and fixing exposed hardcoded secrets in your GitHub project with Snyk](<https://devfeed.tech/articles/finding-and-fixing-exposed-hardcoded-secrets-in-your-github-project-with-snyk-7925.md>)

Original publisher: [Read original article](<https://snyk.io/blog/fixing-exposed-hardcoded-secrets/>)

Author: Chandler Mayo

Published: 2024-06-25T17:00:00Z

Content type: tutorial

Language: en

Sources: [Blog RSS Feed | Snyk](<https://devfeed.tech/sources/blog-rss-feed-snyk.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [Node.js](<https://devfeed.tech/topics/node-js.md>), [Reverse Dependencies](<https://devfeed.tech/topics/reverse-dependencies.md>), [Boilerplate](<https://devfeed.tech/topics/boilerplate.md>)

Tags: [awareness](<https://devfeed.tech/tags/awareness.md>), [blog](<https://devfeed.tech/tags/blog.md>), [code](<https://devfeed.tech/tags/code.md>), [code-security](<https://devfeed.tech/tags/code-security.md>), [dependencies](<https://devfeed.tech/tags/dependencies.md>), [developer](<https://devfeed.tech/tags/developer.md>), [devrel](<https://devfeed.tech/tags/devrel.md>), [github](<https://devfeed.tech/tags/github.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [node-js](<https://devfeed.tech/tags/node-js.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [snyk](<https://devfeed.tech/tags/snyk.md>), [snyk-code](<https://devfeed.tech/tags/snyk-code.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

## AI overview

This tutorial explains how to use Snyk to find hardcoded secrets and credentials in a GitHub project, then refactor the code to store those secrets with Doppler. It uses the open source Snyk goof Node.js boilerplate project and also covers dependency analysis, vulnerability reporting, and automated fix pull requests.

## Source excerpt

In this blog, we'll show how you can use Snyk to locate hardcoded secrets and credentials and then refactor our code to use Doppler to store those secrets instead.