AG-ENV-FALLBACK: Hardcoded Secret as os.getenv() Fallback

What this rule means

An `os.getenv()` call has a hardcoded secret as its default value. If the environment variable is unset — a misconfigured CI job, a fresh developer machine, a container without env injection — the hardcoded credential is used silently, with no error.

Why it matters

A generic but common pattern in agent codebases; the credential is also visible in source, git history, and any artifact packaging the code, independent of whether the fallback ever actually fires.

How to fix it

Remove the fallback entirely: `os.environ['KEY']` raises if missing, which is the correct failure mode for a secret.

Detect it

pip install lucin
lucin scan .                  # all rules
lucin explain AG-ENV-FALLBACK          # this rule, in your terminal

Findings carry a file:line and, where the rule supports it, a witness path showing the flow that triggered it. Precision and recall for the whole rule set, with the commands that regenerate them, are on the benchmarks page — and the gaps are on limits.

← All detection rules