An oauth2.Config is built with a hardcoded string-literal ClientSecret.

Why this matters

The client secret authenticates your application to the authorization server; committed to source control it is one search away from compromise, letting an attacker impersonate your client and redeem authorization codes for tokens (CWE-798). LLMs routinely inline the secret to make an OAuth sample runnable.

Load it from the environment or a secret manager instead: conf := &oauth2.Config{ ClientID: os.Getenv("OAUTH_CLIENT_ID"), ClientSecret: os.Getenv("OAUTH_CLIENT_SECRET"), } Rotate any secret already committed.

package main

import "golang.org/x/oauth2"

// ruleid: auth.go.oauth.hardcoded-client-secret
var conf = &oauth2.Config{
	ClientID:     "my-client-id",
	ClientSecret: "s3cr3t-hardcoded-client-secret",
	RedirectURL:  "https://app.example.com/callback",
}

package main

import (
	"os"

	"golang.org/x/oauth2"
)

// Secret from the environment: not a literal, not flagged.
var conf = &oauth2.Config{
	ClientID:     os.Getenv("OAUTH_CLIENT_ID"),
	ClientSecret: os.Getenv("OAUTH_CLIENT_SECRET"),
	RedirectURL:  "https://app.example.com/callback",
}

// Obvious placeholder dropped by the allow-list.
var demo = &oauth2.Config{
	ClientID:     "demo",
	ClientSecret: "your-client-secret",
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.go.oauth.hardcoded-client-secret -- <reason>

References