Zennoxa Shield
Rules / Kotlin
SHIELD-KOTLIN-010

Hardcoded secret in source

highKotlinCWE-798CVSS 8.6

What it detects

A password, API key, secret, or token assigned a literal string constant embeds credentials in the app binary.

How to fix

Load secrets from the Android Keystore, encrypted storage, or a secure server-side configuration.

Vulnerable — Shield flags thisApiConfig.kt
object ApiConfig {
    const val baseUrl = "https://api.example.com"
    val apiKey = "not-a-real-key"
}
Fixed — scans cleanApiConfig.kt
import android.content.SharedPreferences

// Provisioned at runtime into EncryptedSharedPreferences (Jetpack Security),
// never compiled into the APK.
class ApiConfig(private val securePrefs: SharedPreferences) {
    val baseUrl = "https://api.example.com"
    fun apiKey(): String =
        securePrefs.getString("api_key", null) ?: error("API key not provisioned")
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-KOTLIN-010, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-KOTLIN-010: Hardcoded secret in source — Zennoxa Shield