Hardcoded Secret (ARCH4110)
Dieser Inhalt ist noch nicht in deiner Sprache verfügbar.
Key java.security.hardcoded-secret · Severity error · Category security · CWE CWE-798
Embedding secrets, API keys, and passwords as string literals in source exposes those credentials the moment the repository or build artifact leaks. Read secrets from configuration or a secret manager.
Incorrect
Section titled “Incorrect”String apiKey = "sk_live_4eC39HqLyjWDarjtT1zdp7dc"; // embedded in sourcePaymentClient client = new PaymentClient(apiKey);Correct
Section titled “Correct”String apiKey = System.getenv("PAYMENT_API_KEY");PaymentClient client = new PaymentClient(apiKey);Load secrets from an environment variable or secret manager; do not embed them in source.