Zennoxa Shield
Rules / Dart
SHIELD-DART-008

Hardcoded secret credential

highDartCWE-798CVSS 8.2

What it detects

A password, API key, or token assigned a literal string embeds a secret in source code.

How to fix

Load secrets from secure storage or environment configuration, never from source literals.

Vulnerable — Shield flags thisapi_config.dart
class ApiConfig {
  static const String baseUrl = "https://api.example.com";
  // NOT a real credential — placeholder for documentation
  static const String apiKey = "fake-key-1234";
}
Fixed — scans cleanapi_config.dart
class ApiConfig {
  static const String baseUrl = "https://api.example.com";
  // Injected at build time: flutter build --dart-define=API_KEY=...
  static const String apiKey = String.fromEnvironment("API_KEY");
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-DART-008, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-DART-008: Hardcoded secret credential — Zennoxa Shield