Hardcoded Secrets in Manifest

CRITICAL CWE-798 · Hardcoded Credentials

Description

Detects hardcoded secrets, passwords, or API keys in Kubernetes manifests.

What Shoulder detects

Secrets, passwords, or API keys are hardcoded in the Kubernetes manifest.

How to fix

Use Kubernetes Secrets with valueFrom.

```yaml
env:
  - name: DB_PASSWORD
    valueFrom:
      secretKeyRef:
        name: db-secret
        key: password
```

Learn more: https://shoulder.dev/learn/kubernetes/cwe-798/hardcoded-secrets

Applies to

Languages

📄 YAML

Frameworks

kubernetes

References

Documentation ↗ Learn about CWE-798

Scan for this issue

Detect with Shoulder CLI

npx @shoulderdev/cli trust --rule=kubernetes-hardcoded-secrets .