{
"id": "rust-hardcoded-secret",
"language": "rust",
"group": "security",
"listingTitle": "Remove hardcoded Rust credentials",
"title": "Remove hardcoded Rust credentials",
"mvvm": false,
"defaultSeverity": "warn",
"legacyGroup": "security",
"why": "A credential stored in source can leak through version history, packages, logs, or compiled artifacts.",
"suggestion": "Load the secret from a dedicated secret store or environment boundary and keep only non-sensitive identifiers in source.",
"version": 1,
"semanticMaturity": "token",
"securityKind": "vulnerability",
"taxonomy": [
"security"
],
"requirements": [
"tokens"
],
"packs": [
"rust",
"cargo"
],
"implementation": "src/languages/rust/rules.rs",
"languages": [
"rust"
],
"frameworks": [],
"languageVersions": [],
"limitations": [
"Only direct string literals assigned to credential-shaped const, static, or let names are inspected.",
"Runtime data flow, generated source, encrypted literals, and secrets returned by macros are not resolved."
]
}