Hardcoded secret (ARCH301)

Key dotnet.security.hardcoded-secret · Severity error · Category security · CWE CWE-798

Passwords, API keys, or connection strings embedded in source leak through version control and are trivially extracted. Credentials must come from configuration or a secret manager.

Incorrect

var connectionString =
    "Server=db;Database=app;User Id=sa;Password=P@ssw0rd123!;";
var client = new SqlConnection(connectionString);

Correct

var connectionString = configuration.GetConnectionString("AppDb");
var client = new SqlConnection(connectionString);

Fix

Read secrets from environment variables, IConfiguration, or a secret manager (Azure Key Vault, user-secrets) rather than embedding literals.