ALL-SECU0004 · credential_written_into_source
Count the credentials a declaration writes down beside a name that promises a secret.
This is a deterministic rule for all languages. Read its implementation.
Definition
Section titled “Definition”Report a literal bound to a name such as password, api_key, token, or secret, whether
the source assigns it or writes it as a default in a signature. A secret written into source
ships everywhere the source ships, so it reaches every clone, every image built from the
repository, and every copy of the history, and rotating it later means hunting down all of
them. The real cost is that the value keeps working long after the commit that leaked it is
forgotten, which turns a one line mistake into an open door nobody is watching.
Evidence
Section titled “Evidence”Each finding names the declaration, the bound name, and the literal as the source writes it. The value is how many literals a declaration writes down under a name that promises a secret.
Exceptions
Section titled “Exceptions”A template a reader is meant to replace is not a credential, so an empty literal and a
placeholder such as changeme or your-api-key are left alone. A name that says where a
secret lives rather than what it is, such as password_file or token_env, holds a location
and is left alone too, and a bare key is a map key far more often than a credential. A
literal handed to a call under a keyword is the same defect, and a language neutral tree
carries the value without the keyword that named it, so that shape is left to the linter of
the language that can read it. A project with its own vocabulary names it through
also_secret.
Examples
Section titled “Examples”def connect(host, password="hunter2"): ...def connect(host, password=os.environ["DB_PASSWORD"]): ...References
Section titled “References”- Generalizes Ruff S105 hardcoded-password-string. Open reference
- Generalizes Ruff S106 hardcoded-password-func-arg
- Generalizes Ruff S107 hardcoded-password-default. Open reference
- Cites “Common Weakness Enumeration”, CWE-798, use of hard-coded credentials. Open reference
- Cites “OWASP Top Ten”, 2021 A07, identification and authentication failures. Open reference