Hardcoded Secret (ARCH9110)

Key swift.security.hardcoded-secret · Severity error · Category security · CWE CWE-798

Flags string literals assigned to secret-looking names (password, apiKey, token, secret, privateKey).

Incorrect

let apiKey = "sk_live_4f9a1b2c3d4e5f6a7b8c"

Correct

let apiKey = try Keychain.read("payment.apiKey")

Fix

Read secrets from the Keychain or the environment; never from source.