thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Foundational

Hard-Coded Credentials

Passwords, API keys or cryptographic keys embedded directly in source code, scripts or binaries.

Definition

Hard-coded secrets leak through source repositories, decompiled apps and container images and are hard to rotate. They are tracked as CWE-798. Secrets should be stored in a secrets manager or injected at runtime, and repositories should be scanned for secrets.

Example

A mobile app contains a cloud storage access key that anyone can extract by decompiling the APK.

Exam tip

Fix with a secrets manager and secret scanning; never just obfuscate the string.

Related terms