RsDoctorrust-doctor · Security
hardcoded-secrets
Flags string literals assigned to secret-named variables (`api_key`, `password`, `token`, `secret`, …) when the value also looks like a real secret — matching a known key shape (AWS, GitHub, Stripe, JWT) or exceeding a Shannon-entropy threshold. Test code and placeholder values are ignored. Hardcoded secrets can be extracted from compiled binaries or version control.
- Severity
- error
- Confidence
- medium
- Analyzer
- syn-ast
- Default policy
- Enabled
Tags
Framework requirements
No framework requirement.
Limitations
- Syntactic analysis does not have rustc name resolution or inferred type information.
Remediation
Use environment variables, a secrets manager, or config files excluded from version control.
Fix capability: guidance