Docker Secrets and Security Best Practices

CRITICAL CWE-798 · Hardcoded Credentials

Description

Detects hardcoded secrets in ENV/ARG and piping curl/wget to shell.

What Shoulder detects

Dockerfile contains {issue_type}: {details}

How to fix

Use BuildKit secrets instead of hardcoding credentials.

```dockerfile
RUN --mount=type=secret,id=token \
    cat /run/secrets/token
```

Learn more: https://shoulder.dev/learn/docker/cwe-798/secrets-security

Applies to

Languages

🐳 Dockerfile

Frameworks

docker

References

Documentation ↗ OWASP ↗ Learn about CWE-798

Scan for this issue

Detect with Shoulder CLI

npx @shoulderdev/cli trust --rule=docker-secrets-security .