Archway automatically scans your bridge code for hardcoded secrets — API keys, tokens, passwords, and other sensitive values that should be stored as secrets instead.

As you write code in the editor, the secret detector runs automatically and shows warnings if it finds patterns that look like hardcoded credentials. You'll see alerts in the Test tab with:

When a hardcoded secret is detected, you can create a proper secret directly from the warning — Archway will pre-fill the secret name and type based on what it detected.

The security review that runs before every deployment also checks for hardcoded secrets. Critical findings (like plaintext API keys) will block deployment until resolved.