Rules / General
SHIELD-GEN-001
Hardcoded IP address
What it detects
Hardcoded IP addresses can expose internal network topology and are inflexible.
How to fix
Use configuration files or environment variables instead of hardcoded IP addresses.
Vulnerable — Shield flags thisconfig.py
# Database connection settings
DB_HOST = "10.42.7.15"
DB_PORT = 5432
DB_NAME = "orders"
Fixed — scans cleanconfig.py
import os
# Database connection settings come from the environment
DB_HOST = os.environ["DB_HOST"]
DB_PORT = int(os.environ.get("DB_PORT", "5432"))
DB_NAME = "orders"
Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-GEN-001, the fixed one does not.