An OAuth client secret / API key / password is assigned from a hard-coded string literal.

Why this matters

A secret shipped inside an APK is trivially recovered by decompiling the app, so a "confidential" client secret embedded in a mobile binary is effectively public (CWE-798). AI-generated Android samples inline the value to make the snippet compile and it ships in the release build.

A public mobile client should use PKCE and hold no client secret at all; any unavoidable key belongs in the build config or a secret store, not in source: val clientSecret = BuildConfig.CLIENT_SECRET // injected at build time val apiKey = System.getenv("API_KEY") and rotate any secret already committed.

object AuthConfig {
    // ruleid: auth.kotlin.android.hardcoded-secret
    const val CLIENT_SECRET = "aRq83Kd9sLp2mZx7Qw1nB4vT"

    // ruleid: auth.kotlin.android.hardcoded-secret
    val apiKey = "sk_live_9f83jd0292kfovnw83hd"

    // ruleid: auth.kotlin.android.hardcoded-secret
    private val password = "Sup3rSecretPassword99"
}

object AuthConfig {
    // injected from build config: safe
    val clientSecret = BuildConfig.CLIENT_SECRET

    // read from environment: safe
    val apiKey = System.getenv("API_KEY")

    // non-credential name: safe
    const val userName = "a_very_long_username_value_here"

    // documentation placeholder: safe
    const val secret = "your-client-secret-here"
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.kotlin.android.hardcoded-secret -- <reason>

References