MEDIUM AI PREVALENCE: HIGH auth.iac.ci-hardcoded-oauth-secret

A secret-like key (client_secret, token, password, api_key, ...) is assigned a hard-coded literal in this CI workflow instead of being read from the secret store.

CWE-798 OWASP A07:2021 YAML

Why AI tools produce this: AI coding tools generate this anti-pattern by default, it appears in a large share of AI-written auth code.

Why this matters

Anything committed here lives in git history and in every build log forever, so the credential must be treated as leaked and rotated. Reference it from the CI secret store instead, for example ${{ secrets.OKTA_CLIENT_SECRET }} in GitHub Actions or a masked CI variable, and remove the literal from the file.

VULNERABLE

vulnerable.yaml

name: Deploy
on: push
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Configure
        env:
          # ruleid: auth.iac.ci-hardcoded-oauth-secret
          CLIENT_SECRET: "8f3b9c1d2e4a5f6079a1b2c3d4e5f6a7b8c9d0e1"
          # ruleid: auth.iac.ci-hardcoded-oauth-secret
          OKTA_CLIENT_SECRET: hardcoded-super-secret-value-1234567890
        run: ./deploy.sh

SAFE

safe.yaml

name: Deploy
on: push
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Configure
        env:
          TOKEN_URL: "https://auth.example.com/oauth/token"
          CLIENT_SECRET: ${{ secrets.CLIENT_SECRET }}
          OKTA_CLIENT_SECRET: ${{ secrets.OKTA_CLIENT_SECRET }}
        run: ./deploy.sh

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.iac.ci-hardcoded-oauth-secret -- <reason>

References

https://cwe.mitre.org/data/definitions/798.html ↗https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions ↗