owlwarden

Fix credential hardcoded in source in Sails.js

A credential appears as a literal in source. Anything committed is in the repository's history, in every clone, and in every build artefact, so removing the line later does not revoke it. Read secrets from the environment or a secret manager, and rotate anything that has been committed.

high likely Sails.js CWE-798 / OWASP A07:2021

The vulnerable pattern in Sails.js

HIGH likely Credential hardcoded in source A07:2021 api/controllers/billing.js:3:20 1 │ // hardcoded-secret: a Stripe live key committed to the repository. 2 │ // Non-alphanumeric character keeps GitHub push protection from blocking the repo. 3 │ const STRIPE_KEY = 'sk_l***' │ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ credential written into source 4 │ 5 │ async function charge(amountCents) {

This finding comes from the Sails.js fixture in the owlwarden test suite, in /billing. This literal carries the prefix of a Stripe live secret key, so it is a real credential rather than a placeholder. It is in the repository's history and in every clone; deleting the line does not revoke it.

The corrected handler

Put it in config/local.js (or the environment) rather than the source.

// config/local.js
module.exports = {
  custom: {
    apiKey: process.env.API_KEY,
  },
}

If you are not using Sails.js

Move the value into an environment variable or a secret manager, and rotate it - once committed it is in the history and in every clone, so removing the line does not revoke it.

Check your own repository

npx owlwarden scan
npx owlwarden explain hardcoded-secret

Runs on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.

Other Sails.js checks

Rules with a tested Sails.js example.

hardcoded-secret for every framework / All rules / owlwarden