Zennoxa Shield
Rules / Java
SHIELD-JAVA-010

Hardcoded Credentials

highJavaCWE-798CVSS 8.1

What it detects

A password, secret, or API key assigned as a string literal exposes credentials in source.

How to fix

Load secrets from environment variables or a secrets manager, never from source code.

Vulnerable — Shield flags thisDatabaseConfig.java
import java.sql.Connection;
import java.sql.DriverManager;

public class DatabaseConfig {
    private static final String DB_PASSWORD = "hunter2";

    public Connection open(String url, String user) throws Exception {
        return DriverManager.getConnection(url, user, DB_PASSWORD);
    }
}
Fixed — scans cleanDatabaseConfig.java
import java.sql.Connection;
import java.sql.DriverManager;

public class DatabaseConfig {
    public Connection open(String url, String user) throws Exception {
        String dbPassword = System.getenv("DB_PASSWORD");
        return DriverManager.getConnection(url, user, dbPassword);
    }
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-JAVA-010, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-JAVA-010: Hardcoded Credentials — Zennoxa Shield