Hardcoded secret (ARCH2110)

Ce contenu n’est pas encore disponible dans votre langue.

Key python.security.hardcoded-secret · Severity error · Category security · CWE CWE-798

Embedding passwords, API keys, tokens, and private keys as string literals in source exposes them to anyone with repository access. Leaked secrets cannot be rotated easily.

Incorrect

DB_PASSWORD = "P@ssw0rd123!"
client = connect(user="app", password=DB_PASSWORD)

Correct

import os

DB_PASSWORD = os.environ["DB_PASSWORD"]
client = connect(user="app", password=DB_PASSWORD)

Fix

Read secrets from environment variables or a secrets manager; never keep them in source.