no-hardcoded-api-key

Forbid a literal API key in the Anthropic client options.

• CWE: CWE-798 — Use of Hard-coded Credentials
• OWASP: A07:2021 — Identification and Authentication Failures
• CVSS: 9.1 (Critical) · Recommended: error

Why

A key written into source is committed, pushed, mirrored into every clone and CI cache, and is billable by anyone who reads it. Because rotating it means a code change, leaked keys tend to stay live far longer than they should.

Covers apiKey and authToken on both @anthropic-ai/sdk and @anthropic-ai/claude-agent-sdk. An empty string is treated as a placeholder, not a credential.

Incorrect

import Anthropic from '@anthropic-ai/sdk';
const client = new Anthropic({ apiKey: 'sk-ant-api03-...' });

Correct

import Anthropic from '@anthropic-ai/sdk';
const client = new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY });