SH201: Hard-coded secret

Severity: high · Category: secrets · Applies to: all projects

Why it matters

Credentials committed to source control can be read by anyone with access to the repository, including its full history, and are hard to revoke once leaked.

How to fix

Revoke the credential, move it to an environment variable or secret manager, and remove it from git history.

Ignoring this rule

Skip it everywhere in devshield.yml:

ignore:
  - SH201

Or skip one line with a comment on that line or the line above:

devshield-ignore: SH201