Hardcoded secret (ARCH2110)

Dieser Inhalt ist noch nicht in deiner Sprache verfügbar.

Key python.security.hardcoded-secret · Severity error · Category security · CWE CWE-798

Embedding passwords, API keys, tokens, and private keys as string literals in source exposes them to anyone with repository access. Leaked secrets cannot be rotated easily.

Incorrect

DB_PASSWORD = "P@ssw0rd123!"
client = connect(user="app", password=DB_PASSWORD)

Correct

import os

DB_PASSWORD = os.environ["DB_PASSWORD"]
client = connect(user="app", password=DB_PASSWORD)

Fix

Read secrets from environment variables or a secrets manager; never keep them in source.