Why AI tools produce this: AI coding tools generate this anti-pattern by default, it appears in a large share of AI-written auth code.
Why this matters
Committed to source control it is one search away from compromise, letting an attacker reuse it against the backing service (CWE-798). AI-generated code inlines the value to make the snippet "just work" and it ships unchanged.
Read the value from the environment, an xcconfig / Info.plist build setting, or a secret store instead, e.g. ProcessInfo.processInfo.environment["API_KEY"], and rotate the leaked secret out of source control.
VULNERABLE
vulnerable.swift
import Foundationstruct Config { // ruleid: auth.swift.secret.hardcoded-credential let apiKey = "sk_live_51H8xInLqQ2mNpQ" // ruleid: auth.swift.secret.hardcoded-credential static let clientSecret = "abcdef1234567890XYZ" // ruleid: auth.swift.secret.hardcoded-credential var password = "s3cr3t_p4ssw0rd_9999" // ruleid: auth.swift.secret.hardcoded-credential private let jwtSigningToken = "hunter2_signing_key_2026"}
SAFE
safe.swift
import Foundationstruct Config { // Read from the environment, not a literal. let apiKey = ProcessInfo.processInfo.environment["API_KEY"] let clientSecret = ProcessInfo.processInfo.environment["CLIENT_SECRET"]! // Empty / short / placeholder literals are not real secrets. let secret = "" let token = "abc" let apiSecret = "YOUR_SECRET_HERE_XXXX" let accessKey = "<replace-with-key-here>" // Non-secret names are ignored even with a long literal. let username = "maurice.aney.longname"}
Suppressing this rule
If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.