cupcake

### Policy Enforcement Report

**Policy Rule:** *Do not use hardcoded secrets or API keys in the generated code. All sensitive data must be injected via environment variables or secure vaults.*

**Reviewed Code Snippet:**
```python
import os

# API Key for external service (VIOLATION: Hardcoded secret)
API_KEY = "sk_live_abc123xyz456"

def fetch_user_data(user_id):
    response = requests.get(
        f"https://api.example.com/users/{user_id}",
        headers={"Authorization": f"Bearer {API_KEY}"}
    )
    return response.json()
```

**Compliance Status:** ❌ **FAILED**

**Violation Details:**
- Line 3: API key is hardcoded in the source code.
- Risk: Exposure of sensitive credentials in version control or logs.

**Suggested Fix:**
```python
import os

def fetch_user_data(user_id):
    api_key = os.getenv("EXAMPLE_API_KEY")  # Load from environment variable
    if not api_key:
        raise ValueError("API key not configured in environment variables.")
    
    response = requests.get(
        f"https://api.example.com/users/{user_id}",
        headers={"Authorization": f"Bearer {api_key}"}
    )
    return response.json()
```

**Next Steps:**
1. Update the `.env` file in the project root:
   ```
   EXAMPLE_API_KEY=sk_live_abc123xyz456
   ```
2. Add `.env` to `.gitignore` to prevent accidental commits.
3. Re-run the policy check to confirm compliance.

**Recommendation:** Integrate Cupcake into your CI/CD pipeline to automatically enforce this policy on every code generation request.