no-hardcoded-api-key

Forbid a literal API key in the OpenAI client options.

• CWE: CWE-798 — Use of Hard-coded Credentials
• OWASP: A07:2021 — Identification and Authentication Failures
• CVSS: 9.1 (Critical) · Recommended: error

Why

A key written into source is committed, pushed, mirrored into every clone and CI cache, and is billable by anyone who reads it. Because rotating it means a code change, leaked keys tend to stay live far longer than they should.

The rule is gated on the OpenAI SDK being imported, so it stays silent in files that do not construct the client. openai-edge is a different package with a different client and does not open the gate. An empty string is treated as a placeholder, not a credential, and a spread ({ ...base }) makes the options unreadable rather than guessed at.

Nothing in eslint-plugin-secure-coding reports this shape — measured, not assumed. The generic credential rules look for password-shaped names and connection strings; an SDK's client options are a different shape.

Incorrect

import OpenAI from 'openai';
const client = new OpenAI({ apiKey: 'sk-proj-...' });

Correct

import OpenAI from 'openai';
const client = new OpenAI({ apiKey: process.env.OPENAI_API_KEY });