Hardcoded Secret (ARCH8110)
Key kotlin.security.hardcoded-secret · Severity error · Category security · CWE CWE-798
Flags string literals assigned to secret-looking names (password, apiKey, token, secret, privateKey). A namespaced identifier value (com.example.session.token) is a preference key, not a secret.
Incorrect
Section titled “Incorrect”val apiKey = "sk_live_4f9a1b2c3d4e5f6a7b8c"Correct
Section titled “Correct”val apiKey = System.getenv("PAYMENT_API_KEY") ?: error("missing key")Read secrets from the environment, a vault or the platform keystore.