Zennoxa Shield
Rules / C/C++
SHIELD-CPP-015

Hardcoded credential literal

highC/C++CWE-798CVSS 8.6

What it detects

A password or secret assigned a string literal embeds a credential in source.

How to fix

Load secrets from environment variables or a secrets manager at runtime.

Vulnerable — Shield flags thisdb_config.c
#include <stddef.h>

/* credential baked into the binary and the repo */
static char DB_PASSWORD[] = "changeme-example";

const char *db_password(void) {
    return DB_PASSWORD;
}
Fixed — scans cleandb_config.c
#include <stdlib.h>

/* credential supplied by the environment at runtime */
const char *db_password(void) {
    return getenv("DB_PASSWORD");
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-CPP-015, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-CPP-015: Hardcoded credential literal — Zennoxa Shield