SH207: Credential written in an application config file

Severity: high · Category: secrets · Applies to: aspnet, spring

Why it matters

Passwords, API keys and signing keys in application.properties, application.yml or appsettings.json are committed with the code and readable by everyone with access to the repository.

How to fix

Reference an environment variable (${DB_PASSWORD} in Spring, environment variables or user-secrets in .NET) or a secret manager, and rotate the exposed value.

Ignoring this rule

Skip it everywhere in devshield.yml:

ignore:
  - SH207

Or skip one line with a comment on that line or the line above:

devshield-ignore: SH207