Zennoxa Shield
Rules / Rust
SHIELD-RUST-009

Hardcoded credential

highRustCWE-798CVSS 7.5

What it detects

A password, secret, or API key literal embedded in source is a leaked credential.

How to fix

Load secrets from environment variables or a secrets manager, never from source.

Vulnerable — Shield flags thisclient.rs
pub fn build_client() -> ApiClient {
    // Fake example value — but any literal here ships in the binary and git history.
    let api_key = "demo-key-not-real";
    ApiClient::new("https://api.example.com", api_key)
}
Fixed — scans cleanclient.rs
pub fn build_client() -> ApiClient {
    let api_key = std::env::var("API_KEY").expect("API_KEY not set");
    ApiClient::new("https://api.example.com", api_key.as_str())
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-RUST-009, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-RUST-009: Hardcoded credential — Zennoxa Shield