Zennoxa Shield
Rules / JavaScript / TypeScript
SHIELD-JS-011

Hardcoded password or secret

highJavaScript / TypeScriptCWE-798CVSS 7.5

What it detects

Hardcoded credentials in source code can be extracted by attackers.

How to fix

Store secrets in environment variables or a secrets manager. Never hardcode credentials.

Vulnerable — Shield flags thisdb.js
const mysql = require("mysql2");

const pool = mysql.createPool({
  host: "db.internal.example",
  user: "orders_app",
  password: "Sup3rS3cretPassw0rd!",
  database: "orders",
});

module.exports = pool;
Fixed — scans cleandb.js
const mysql = require("mysql2");

const pool = mysql.createPool({
  host: process.env.DB_HOST,
  user: process.env.DB_USER,
  password: process.env.DB_PASSWORD,
  database: "orders",
});

module.exports = pool;

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-JS-011, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-JS-011: Hardcoded password or secret — Zennoxa Shield