# Use of Hard-coded Credentials (CWE-798)

The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

**Stack:** Kubernetes

- Prevalence: 高 频繁被利用
- Impact: 关键 6 条严重级别为关键的规则
- Prevention: 已记录 11 个修复示例

**OWASP:** Identification and Authentication Failures (A07:2021-Identification and Authentication Failures) - #7

## Description

Hard-coded credentials typically create a significant hole that allows an attacker to bypass the authentication that has been configured by the product administrator. This hole might be difficult for the system administrator to detect.

## Prevention

基于 1 条 Shoulder 检测规则的 Hardcoded Credentials 预防策略。

### Kubernetes

Use Kubernetes Secrets with secretKeyRef instead of hardcoding credentials in manifests

## Warning Signs

- [CRITICAL] Secrets, passwords, or API keys are hardcoded in the Kubernetes manifest.
- [CRITICAL] hardcoded secrets, passwords, or API keys in Kubernetes manifests

## Consequences

- 获取权限
- 绕过保护机制

## Mitigations

- 将凭据存放在源代码之外
- 使用环境变量或安全的凭据存储
- 实施适当的密钥管理流程

## Detection

- Total rules: 11
- Critical: 6
- Languages: python, dockerfile, go, javascript, typescript, yaml

## Rules by Language

### Yaml (1 rules)

- **Hardcoded Secrets in Manifest** [CRITICAL]: Detects hardcoded secrets, passwords, or API keys in Kubernetes manifests.
  - Remediation: Use Kubernetes Secrets with valueFrom.

```yaml
env:
  - name: DB_PASSWORD
    valueFrom:
      secretKeyRef:
        name: db-secret
        key: password
```

Learn more: https://shoulder.dev/learn/kubernetes/cwe-798/hardcoded-secrets