← Back to report

Investigate Hardcoded credentials in a URL

Build 2.77.0 · Scan 2026-10-09T04:47:51.374Z

1 distinct recorded findings; 1 have inspectable metadata. Locations are representative, not an inventory of every source match.

A username and password are embedded directly in a URL inside the app. If that host is reachable, this is a hardcoded credential and should be rotated. Confirm it isn't a placeholder/example first.

Static evidence does not establish runtime impact. Source excerpts and line numbers were not recorded.

Evidence preview

Evidence type

Static string match

Representative location

resources.arsc

Recorded match

•••••••• (40+ chars, redacted)

Detector rule

basic_auth_url

Recorded file locations

• resources.arsc