Zennoxa Shield
Rules / Go
SHIELD-GO-009

Hardcoded password or secret

highGoCWE-798CVSS 7.5

What it detects

Hardcoded credentials in Go source code can be extracted by attackers.

How to fix

Use environment variables or a secrets manager instead of hardcoded credentials.

Vulnerable — Shield flags thisdb.go
package config

import "fmt"

func DatabaseDSN(host string) string {
	// Anyone with the binary or repo can extract this credential
	password := "Sup3rS3cretPassw0rd-EXAMPLE"
	return fmt.Sprintf("postgres://app:%s@%s:5432/app", password, host)
}
Fixed — scans cleandb.go
package config

import (
	"fmt"
	"os"
)

func DatabaseDSN(host string) string {
	// Credential comes from the environment / secrets manager at runtime.
	password := os.Getenv("DB_PASSWORD")
	return fmt.Sprintf("postgres://app:%s@%s:5432/app", password, host)
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-GO-009, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-GO-009: Hardcoded password or secret — Zennoxa Shield