falconGitHub

avoid-hardcoded-credentials

Path
lint/security/avoid-hardcoded-credentials
Default
Off, opt in
Origin
Falcon
Rule
68 of 512

Warns when credential-like variables, fields, or parameter defaults use nonempty string or numeric literals.

Names such as password, apiKey, clientSecret, and accessToken are checked case-insensitively, including snake_case and private spellings. String values matching their variable name are ignored as storage-key names. Read credentials from secure runtime configuration instead. This is a naming heuristic, not a general-purpose secrets scanner.

Invalid

example.dartdart
const password = 'not-a-real-password';
class Settings {
  final _apiKey = 'fixture-key';
  String clientSecret = '';
  void update() {
    clientSecret = 'fixture-secret';
    this.clientSecret = 'other-fixture-secret';
  }
}
const ACCESS_TOKEN = 'fixture-token';

void connect({String password = 'fixture-password'}) {}
void authenticate([String apiKey = 'fixture-key']) {}
void configure({String client_secret = ('fixture-secret')}) {}
void unlock({int passwd = 1234}) {}
void authorize([double authToken = 1.5]) {}

class Connection {
  final String password;
  Connection({this.password = 'fixture-password'});
  Connection.positional([this.password = 'fixture-password']);
  Connection.named({String secret = 'fixture-secret'}) : password = secret;
  void login({String accessToken = 'fixture-token'}) {}
  void refresh([String privateKey = 'fixture-key']) {}
}

class ChildConnection extends Connection {
  ChildConnection({super.password = 'fixture-password'});
  ChildConnection.positional([super.password = 'fixture-password']) : super.positional();
}

void callbacks() {
  void local([String _PASSWORD = 'fixture-password']) {}
  final named = ({String api_key = 'fixture-key'}) {};
  final positional = ([String clientSecret = 'fixture-secret']) {};
}
Credential-like name is assigned a hardcoded value; read the credential from secure runtime configuration.
1const password = 'not-a-real-password';
Credential-like name is assigned a hardcoded value; read the credential from secure runtime configuration.
2class Settings {
3 final _apiKey = 'fixture-key';
Credential-like name is assigned a hardcoded value; read the credential from secure runtime configuration.
5 void update() {
6 clientSecret = 'fixture-secret';
Credential-like name is assigned a hardcoded value; read the credential from secure runtime configuration.
6 clientSecret = 'fixture-secret';
7 this.clientSecret = 'other-fixture-secret';
Credential-like name is assigned a hardcoded value; read the credential from secure runtime configuration.
9}
10const ACCESS_TOKEN = 'fixture-token';
Credential-like name is assigned a hardcoded value; read the credential from secure runtime configuration.
11
12void connect({String password = 'fixture-password'}) {}
Credential-like name is assigned a hardcoded value; read the credential from secure runtime configuration.
12void connect({String password = 'fixture-password'}) {}
13void authenticate([String apiKey = 'fixture-key']) {}
Credential-like name is assigned a hardcoded value; read the credential from secure runtime configuration.
13void authenticate([String apiKey = 'fixture-key']) {}
14void configure({String client_secret = ('fixture-secret')}) {}
Credential-like name is assigned a hardcoded value; read the credential from secure runtime configuration.
14void configure({String client_secret = ('fixture-secret')}) {}
15void unlock({int passwd = 1234}) {}
Credential-like name is assigned a hardcoded value; read the credential from secure runtime configuration.
15void unlock({int passwd = 1234}) {}
16void authorize([double authToken = 1.5]) {}
Credential-like name is assigned a hardcoded value; read the credential from secure runtime configuration.
19 final String password;
20 Connection({this.password = 'fixture-password'});
Credential-like name is assigned a hardcoded value; read the credential from secure runtime configuration.
20 Connection({this.password = 'fixture-password'});
21 Connection.positional([this.password = 'fixture-password']);
Credential-like name is assigned a hardcoded value; read the credential from secure runtime configuration.
21 Connection.positional([this.password = 'fixture-password']);
22 Connection.named({String secret = 'fixture-secret'}) : password = secret;
Credential-like name is assigned a hardcoded value; read the credential from secure runtime configuration.
22 Connection.named({String secret = 'fixture-secret'}) : password = secret;
23 void login({String accessToken = 'fixture-token'}) {}
Credential-like name is assigned a hardcoded value; read the credential from secure runtime configuration.
23 void login({String accessToken = 'fixture-token'}) {}
24 void refresh([String privateKey = 'fixture-key']) {}
Credential-like name is assigned a hardcoded value; read the credential from secure runtime configuration.
27class ChildConnection extends Connection {
28 ChildConnection({super.password = 'fixture-password'});
Credential-like name is assigned a hardcoded value; read the credential from secure runtime configuration.
28 ChildConnection({super.password = 'fixture-password'});
29 ChildConnection.positional([super.password = 'fixture-password']) : super.positional();
Credential-like name is assigned a hardcoded value; read the credential from secure runtime configuration.
32void callbacks() {
33 void local([String _PASSWORD = 'fixture-password']) {}
Credential-like name is assigned a hardcoded value; read the credential from secure runtime configuration.
33 void local([String _PASSWORD = 'fixture-password']) {}
34 final named = ({String api_key = 'fixture-key'}) {};
Credential-like name is assigned a hardcoded value; read the credential from secure runtime configuration.
34 final named = ({String api_key = 'fixture-key'}) {};
35 final positional = ([String clientSecret = 'fixture-secret']) {};

Valid

example.dartdart
String readSecret() => '';
final password = readSecret();
const apiKey = '';
const secretCount = 3;
const token = 'not-a-credential-name';
const accessToken = 'access_token';
const _authToken = 'AUTH-TOKEN';
class StorageKeys {
  static const password = 'password';
}
void update(String supplied) {
  final clientSecret = supplied;
  final accessToken = 'prefix-$supplied';
}

const configuredSecret = 'fixture-configured-value';
void connect({
  String password = '',
  String? passwd = null,
  String clientSecret = configuredSecret,
  String apiKey = 'API-KEY',
  String token = 'not-a-credential-name',
  int secretCount = 3,
}) {}
void authenticate([String password = 'password']) {}
void storageKey([String _access_token = 'accessToken']) {}
void requiredCredentials(String password, {required String apiKey}) {}

class Connection {
  final String password;
  Connection({this.password = 'password'});
  Connection.positional([this.password = configuredSecret]);
  void login({String authToken = 'auth_token'}) {}
  void refresh([String privateKey = configuredSecret]) {}
}

class ChildConnection extends Connection {
  ChildConnection({super.password = ''});
  ChildConnection.positional([super.password = 'password']) : super.positional();
}

void callbacks() {
  void local({String secret = 'secret'}) {}
  final named = ({String apiKey = configuredSecret}) {};
  final positional = ([String clientSecret = 'CLIENT-SECRET']) {};
}

Configure avoid-hardcoded-credentials

Set its severity in falcon.json. See the configuration guide.

falcon.jsonjson
{
  "linter": {
    "rules": {
      "security": {
        "avoid-hardcoded-credentials": "error"
      }
    }
  }
}

Or silence one occurrence with a suppression comment; the reason is required.

example.dartdart
// falcon-ignore lint/security/avoid-hardcoded-credentials: <reason>