Hardcoded Credentials
Description
Detects hardcoded passwords, API keys, tokens, and other credentials in source code. Credentials should be stored in environment variables or secure vaults.
How to fix
Store credentials in environment variables instead of source code.
```python
import os
password = os.getenv('DB_PASSWORD')
api_key = os.environ['API_KEY']
secret_key = os.getenv('SECRET_KEY')
```
Learn more: https://shoulder.dev/learn/python/cwe-798/hardcoded-credentials
Applies to
Languages
Frameworks
django
flask
fastapi
References
Scan for this issue
Detect with Shoulder CLI
npx @shoulderdev/cli trust --rule=python-hardcoded-credentials .