# Hardcoded Configuration

> A defect in which environment, credential or policy values are written into code instead of being supplied as configuration.

Record: `architecture:hardcoded-configuration`
Kind: anti-pattern
Layer: [Enforcement Core](https://banes-lab.com/records/layer/enforcement-core.md)
Severity: discouraged
Scope: semantic_consistency, state_transaction
Canonical: https://banes-lab.com/ontology#architecture-hardcoded-configuration

Listed in [Architecture principles](https://banes-lab.com/api/records/architecture.md), after [Implicit Contract](https://banes-lab.com/records/architecture/implicit-contract.md) and before [Shared Mutable State](https://banes-lab.com/records/architecture/shared-mutable-state.md).

## Repair

- Refactored by: externalize_configuration, add_config_schema, centralize_config_source, validate_environment, remove_secret_from_code
- Detected by: hardcoded_URL, hardcoded_path, hardcoded_secret, environment_branching_in_code, duplicated_config_literal
- Violated by: Embed environment, path, credential, feature, service endpoint, or policy values directly into code, then duplicate those assumptions across runtime contexts.
- Measured by: configuration literals and secrets found in source
- Enforced by: configuration and secret scans, a configuration schema validated at startup

## Severity

- [discouraged](https://banes-lab.com/records/vocabulary/severity-discouraged.md)

## Category

- [Anti-patterns](https://banes-lab.com/records/architecture-category/anti-patterns.md)

## Force

- [Semantic consistency](https://banes-lab.com/records/force/semantic-consistency.md)
- [State transaction](https://banes-lab.com/records/force/state-transaction.md)

## Detected by

- [codemods/entrypoints/location.entrypoint.ts](https://banes-lab.com/source/governance/codemods/entrypoints/location.entrypoint.ts.md)
- [rules/eslint/closure-paths-via-ssot.eslint.rule.ts](https://banes-lab.com/source/governance/rules/eslint/closure-paths-via-ssot.eslint.rule.ts.md)
- [rules/eslint/no-hardcoded-exclusions.eslint.rule.ts](https://banes-lab.com/source/governance/rules/eslint/no-hardcoded-exclusions.eslint.rule.ts.md)
- [rules/eslint/no-inline-asset-path.eslint.rule.ts](https://banes-lab.com/source/governance/rules/eslint/no-inline-asset-path.eslint.rule.ts.md)
- [rules/eslint/no-port-literal.eslint.rule.ts](https://banes-lab.com/source/governance/rules/eslint/no-port-literal.eslint.rule.ts.md)

## Negated by

- [Configuration Externalization](https://banes-lab.com/records/architecture/configuration-externalization.md)
- [Declarative Configuration](https://banes-lab.com/records/architecture/declarative-configuration.md)

## Linked from

- [Semantic operations](https://banes-lab.com/pag/guide/tool-invocation.md)
- [One home](https://banes-lab.com/disciplined-methodology/build/one-home.md)
- [Anti-patterns](https://banes-lab.com/ontology/principles/architecture-category-anti-patterns.md)
- [Portability / Infrastructure / Deployment](https://banes-lab.com/ontology/principles/architecture-category-portability-infrastructure-deployment.md)
- [Metadata / Self-Description / Declarative Systems](https://banes-lab.com/ontology/principles/architecture-category-metadata-self-description-declarative-systems.md)
- [Severity levels](https://banes-lab.com/ontology/schema/the-vocabulary-severity.md)
- [The forces](https://banes-lab.com/ontology/schema/the-forces.md)