Hardcoded Secret (ARCH5110)
Esta página aún no está disponible en tu idioma.
Key go.security.hardcoded-secret · Severity error · Category security · CWE CWE-798
Secrets, API keys, passwords, and private keys embedded as literals leak into version control and build artifacts. Once leaked, a secret can be abused until it is rotated.
Incorrect
Section titled “Incorrect”const apiKey = "sk_live_4eC39HqLyjWDarjtT1zdp7dc"client := stripe.New(apiKey)Correct
Section titled “Correct”apiKey := os.Getenv("STRIPE_API_KEY")client := stripe.New(apiKey)Load secrets from environment variables or a secret manager; never embed literals in source.