Zennoxa Shield
Rules / Kotlin
SHIELD-KOTLIN-017

Password stored in plaintext SharedPreferences

highKotlinCWE-312CVSS 7.5

What it detects

Writing a password or secret into standard SharedPreferences stores it unencrypted on the device.

How to fix

Use EncryptedSharedPreferences (Jetpack Security) or the Android Keystore for sensitive values.

Vulnerable — Shield flags thisCredentialStore.kt
import android.content.Context

fun saveCredentials(context: Context, password: String) {
    val prefs = context.getSharedPreferences("auth", Context.MODE_PRIVATE)
    prefs.edit().putString("password", password).apply()
}
Fixed — scans cleanCredentialStore.kt
import android.content.Context
import androidx.security.crypto.EncryptedSharedPreferences
import androidx.security.crypto.MasterKey

fun saveSession(context: Context, sessionId: String) {
    val masterKey = MasterKey.Builder(context)
        .setKeyScheme(MasterKey.KeyScheme.AES256_GCM).build()
    val prefs = EncryptedSharedPreferences.create(
        context, "auth", masterKey,
        EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
        EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM)
    prefs.edit().putString("session_id", sessionId).apply()
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-KOTLIN-017, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-KOTLIN-017: Password stored in plaintext SharedPreferences — Zennoxa Shield