Zennoxa Shield
Rules / C#
SHIELD-CSHARP-015

Hardcoded credential in source

highC#CWE-798CVSS 8.4

What it detects

A password or connection string secret is embedded as a literal in the source code.

How to fix

Load secrets from a secrets manager, environment variable, or protected configuration store.

Vulnerable — Shield flags thisBillingRepository.cs
using Microsoft.Data.SqlClient;

public class BillingRepository
{
    private const string DbUser = "billing_app";
    private const string DbPassword = "S3cret!"; // hardcoded credential

    public SqlConnection Open() =>
        new SqlConnection($"Server=billing-db;User Id={DbUser};Password={DbPassword};");
}
Fixed — scans cleanBillingRepository.cs
using Microsoft.Data.SqlClient;

public class BillingRepository
{
    public SqlConnection Open()
    {
        var builder = new SqlConnectionStringBuilder
        {
            DataSource = "billing-db",
            UserID = "billing_app",
            Password = Environment.GetEnvironmentVariable("BILLING_DB_PASSWORD"),
        };
        return new SqlConnection(builder.ConnectionString);
    }
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-CSHARP-015, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-CSHARP-015: Hardcoded credential in source — Zennoxa Shield