{
"id": "java-hardcoded-secret",
"language": "java",
"group": "security",
"listingTitle": "Java hardcoded secret",
"title": "Review hardcoded secret",
"mvvm": false,
"defaultSeverity": "warn",
"legacyGroup": "security",
"why": "Credentials embedded in source can leak through version control, logs, or distributed artifacts.",
"suggestion": "Load the credential from a dedicated secret provider or deployment-time environment.",
"version": 5,
"semanticMaturity": "text",
"securityKind": "hotspot",
"taxonomy": [
"security"
],
"requirements": [
"sourceText"
],
"packs": [
"java"
],
"implementation": "src/languages/java/rules.rs",
"languages": [
"java"
],
"frameworks": [],
"languageVersions": [],
"limitations": [
"Symbolic token labels, metadata and configuration keys, option and query names, status text, placeholders, and runtime secret lookups are excluded."
]
}