no-hardcoded-credentials

🔒 CWE-798 OWASP:A04 CVSS:9.8 | Hardcoded Credentials detected | CRITICAL [SOC2,PCI-DSS,HIPAA,GDPR,ISO27001,NIST-CSF]
   Fix: Review and apply the recommended fix | https://owasp.org/Top10/A04_2021/

// Hardcoded API key
const apiKey = 'sk_live_FAKE_LIVE_KEY_FOR_TESTING_PURPOSES_ONLY_1234567890';

// Hardcoded password
const password = 'admin123';

// Hardcoded JWT token
const token =
  'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c';

// Database connection string with credentials
const dbUrl = 'mysql://user:password@localhost:3306/dbname';

// AWS access key
const awsKey = 'AKIAIOSFODNN7EXAMPLE';

// Environment variable
const apiKey = process.env.API_KEY;

// Secret manager
const password = await getSecret('database-password');

// Configuration service
const token = configService.get('JWT_TOKEN');

// Environment variable for database
const dbUrl = process.env.DATABASE_URL;

// AWS SDK with IAM roles (no keys needed)
const s3 = new AWS.S3(); // Uses IAM role

{
  rules: {
    'secure-coding/no-hardcoded-credentials': ['error', {
      ignorePatterns: ['^test-'],           // Ignore test credentials
      allowInTests: false,                  // Allow in test files
      minLength: 8,                         // Minimum credential length
      detectApiKeys: true,                  // Detect API keys
      detectPasswords: true,                // Detect passwords
      detectTokens: true,                   // Detect tokens
      detectDatabaseStrings: true          // Detect database strings
    }]
  }
}

{
  rules: {
    'secure-coding/no-hardcoded-credentials': ['error', {
      ignorePatterns: ['^test-', '^mock-', '^fake-']
    }]
  }
}

{
  rules: {
    'secure-coding/no-hardcoded-credentials': ['error', {
      allowInTests: true  // Allows credentials in .test.ts and .spec.ts files
    }]
  }
}

// ✅ Good
const apiKey = process.env.STRIPE_API_KEY;
if (!apiKey) {
  throw new Error('STRIPE_API_KEY is required');
}

// ✅ Good - AWS Secrets Manager
import { SecretsManager } from '@aws-sdk/client-secrets-manager';

const client = new SecretsManager({ region: 'us-east-1' });
const secret = await client.getSecretValue({ SecretId: 'api-keys' });
const apiKey = JSON.parse(secret.SecretString).stripeKey;

// ✅ Good - Config service
import { ConfigService } from '@nestjs/config';

@Injectable()
export class ApiService {
  constructor(private config: ConfigService) {}

  getApiKey() {
    return this.config.get<string>('API_KEY');
  }
}

# ✅ Good - Use .env files (gitignored)
echo "API_KEY=sk_live_FAKE_KEY_FOR_TESTING" >> .env
echo ".env" >> .gitignore

// ❌ NOT DETECTED - From config
const password = config.dbPassword;

// ❌ NOT DETECTED - Env var
const secret = process.env.API_KEY;

// ❌ NOT DETECTED - Dynamic
const cred = credentials[type];