Zennoxa Shield
Rules / Python
SHIELD-PY-011

Hardcoded password or secret

highPythonCWE-798CVSS 7.5

What it detects

Hardcoded credentials in source code can be extracted by attackers.

How to fix

Store secrets in environment variables or a secrets manager. Never hardcode credentials.

Vulnerable — Shield flags thisdb.py
import psycopg2

DB_PASSWORD = "Sup3rS3cretExamplePassw0rd"

def connect():
    return psycopg2.connect(
        host="db.internal",
        user="app",
        password=DB_PASSWORD,
    )
Fixed — scans cleandb.py
import os
import psycopg2

def connect():
    return psycopg2.connect(
        host="db.internal",
        user="app",
        password=os.environ["DB_PASSWORD"],
    )

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-PY-011, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-PY-011: Hardcoded password or secret — Zennoxa Shield