Zennoxa Shield
Rules / Swift
SHIELD-SWIFT-009

Hardcoded secret in source

highSwiftCWE-798CVSS 8.2

What it detects

A password, API key, or token is assigned a hardcoded string literal.

How to fix

Load secrets from the Keychain or a secure configuration service, never from source.

Vulnerable — Shield flags thisPaymentsClient.swift
import Foundation

struct PaymentsClient {
    let apiKey = "SK_FAKE_EXAMPLE_KEY_0000"

    func authHeader() -> String {
        return "Bearer " + apiKey
    }
}
Fixed — scans cleanPaymentsClient.swift
import Foundation
import Security

struct PaymentsClient {
    func apiKey() -> String? {
        let query: [String: Any] = [kSecClass as String: kSecClassGenericPassword,
                                    kSecAttrAccount as String: "payments-api",
                                    kSecReturnData as String: true]
        var item: CFTypeRef?
        guard SecItemCopyMatching(query as CFDictionary, &item) == errSecSuccess,
              let data = item as? Data else { return nil }
        return String(data: data, encoding: .utf8)
    }
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-SWIFT-009, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-SWIFT-009: Hardcoded secret in source — Zennoxa Shield