Rules / Ruby
SHIELD-RUBY-019
Hardcoded secret or password
What it detects
Assigning a literal password, secret key, or API key in source code exposes credentials.
How to fix
Load secrets from environment variables or Rails encrypted credentials.
Vulnerable — Shield flags thisconfig/initializers/payment.rb
Payment.configure do |config|
config.api_key = "demo-key-123456"
config.timeout = 10
end
Fixed — scans cleanconfig/initializers/payment.rb
Payment.configure do |config|
config.api_key = ENV.fetch("PAYMENT_API_KEY")
config.timeout = 10
end
Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-RUBY-019, the fixed one does not.