Hardcoded secrets
Why is this an issue?
Secrets in source code get committed to version control and become visible to anyone with repository access. They can't be rotated without a code change and redeployment, making incident response slow and error-prone.
Examples
Example of incorrect code:
String awsKey = 'AKIALALEMEL33243OLIA';
Example of correct code:
// Use Named Credentials for API authentication
HttpRequest req = new HttpRequest();
req.setEndpoint('callout:My_API/endpoint');
How can I fix violations?
Use Named Credentials: Store API credentials in Named Credentials.
Rotate compromised secrets: If secrets were already committed, treat them as compromised and rotate them immediately.
Resources