# Adapted from gosec rule 'G101 hardcoded_credentials'
# See ../LICENSE and ../NOTICE for license terms.

id: G101-hardcoded-credentials
name: Hardcoded credentials in source
message: Possible hardcoded credential in source
severity: high
category: security
languages: [go]
confidence: 0.7
cwe: CWE-798
pattern: '(?i)(password|passwd|pwd|secret|token|apikey|api_key)\s*[:=]\s*"[^"]{4,}"'
explanation: |
  Storing credentials in Go source — whether as struct fields, package
  vars, or const literals — leaks them to anyone with read access to the
  binary or repo.
recommendation: |
  Read secrets from env vars (``os.Getenv``), KMS, Vault, or Kubernetes
  secrets at runtime.
references:
  - https://github.com/securego/gosec
  - https://cwe.mitre.org/data/definitions/798.html
