Usage of hard-coded secret

Overview

• Rule ID: java_lang_hardcoded_secret

• Applicable Languages: Java

• Weakness ID: CWE-798

Description

Applications should securely store secret values rather than including them as literal values in the source code.

Remediation Guidelines

• Fetch secrets from a secure location during runtime.

References

• OWASP hardcoded passwords

• OWASP secrets management cheat sheet

• CWE-798: Use of Hard-coded Credentials

• OWASP Top 10: A07:2021 - Identification and Authentication Failures

Configuration

To omit this rule during a scan, and to provide you with continuous 24/7 code-level scanning, you can employ our SAST TOOL