What is hardcoding?
Hardcoding is writing a value directly into source code instead of loading it from configuration: an API key pasted into a function, a price embedded in a component, a database address typed where it's used. The value is "hard" in the sense that changing it means editing code.
AI tools hardcode readily, since it's the shortest path to code that runs. That makes hardcoding one of the most common issues in vibe-coded projects, and one of the easiest to catch.
Why is hardcoding risky?
For secrets, it's an exposure path: hardcoded keys travel with the code into repositories and browsers, where scanners and strangers find them. For everything else, it's a maintenance trap: a price, plan name, or URL repeated across files drifts out of sync the first time one copy gets updated and the others don't.
The fix is separation. Secrets move to environment variables; settings that change move to configuration or a single named constant. A one-line audit prompt ("find hardcoded keys, URLs, and settings in this project") plus a scan for values that look like keys covers most of the risk before deployment.
.svg){kind=small}
