hardkoding

Hardcoding refers to the practice of embedding data directly into source code rather than obtaining it from external sources at runtime. This data can include credentials, API endpoints, file paths, numeric constants, or feature flags. While it can simplify a quick script or prototype, hardcoding reduces flexibility, complicates maintenance, and can introduce security risks. It is typically contrasted with retrieving configuration from environment variables, configuration files, command-line arguments, or dynamic lookups from services or databases.

Common examples include a database password embedded in source code, a fixed API URL, a hardcoded file path for logs, or a license key stored in code. These values often need to change across environments or over time, making updates error-prone and labor-intensive. If the code is shared or stored in version control, sensitive data may be exposed, and secrets rotation becomes difficult. Hardcoding can also hinder testing and deployment, since behavior depends on code-level constants rather than configurable inputs.

Best practices encourage externalizing configuration and secrets. Use environment variables, configuration files, or secure secret management systems to provide values at runtime. Where possible, separate configuration from code and inject dependencies rather than embedding them. For production software, avoid including sensitive data in source control and implement proper access controls and auditing. Hardcoding may be acceptable in small, disposable scripts or during early development, but it should be removed before deployment to production to improve security, portability, and maintainability.