Reference detail

CWE-798 — Use of Hard-coded Credentials

Recorded findings mapped to this weakness category. Review the detection and its context in the app report.

Mapped findings are review signals. Interpret each app’s build, scan date and coverage before drawing a conclusion. Historical verification describes only its recorded scan time.

Mapped checks & review guidance (42)

AWS access key ID

Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.

Browse this category

Google API key (client-shipped; restriction unverified)

Restrict the API key (application + API restrictions in Google Cloud Console); a client-shipped key is public, so restriction is the control.

Browse this category

Stripe live secret key

Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.

Browse this category

Slack token

Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.

Browse this category

OpenAI API key

Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.

Browse this category

Anthropic API key

Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.

Browse this category

GitHub personal access token

Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.

Browse this category

GitLab personal access token

Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.

Browse this category

Google OAuth client secret

Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.

Browse this category

SendGrid API key

Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.

Browse this category

Slack incoming webhook URL

Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.

Browse this category

npm access token

Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.

Browse this category

GCP service account credentials

Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.

Browse this category

Azure Storage account key

Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.

Browse this category

Firebase Cloud Messaging legacy server key

Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.

Browse this category

Twilio Account SID

Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.

Browse this category

Mapbox secret token

Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.

Browse this category

Square access/secret token

Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.

Browse this category

Shopify access token

Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.

Browse this category

Discord bot token

Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.

Browse this category

Telegram bot API token

Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.

Browse this category

Cloudinary credentials URL

Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.

Browse this category

Braintree/PayPal production access token

Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.

Browse this category

Stripe restricted API key

Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.

Browse this category

Mailgun API key

Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.

Browse this category

Hugging Face access token

Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.

Browse this category

Groq API key

Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.

Browse this category

Replicate API token

Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.

Browse this category

Perplexity API key

Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.

Browse this category

Database connection string with credentials

Remove the embedded username:password, rotate the credential, and authenticate to the endpoint with short-lived per-user tokens instead.

Browse this category

Twilio API key SID

Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.

Browse this category

Stripe webhook signing secret

Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.

Browse this category

BIP-39 wallet seed phrase

A mnemonic seed phrase must never be embedded — any holder controls the wallet. Move funds to a new wallet immediately and never bundle key material.

Browse this category

DigitalOcean personal access token

Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.

Browse this category

Discord webhook URL

Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.

Browse this category

Linear API key

Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.

Browse this category

PyPI upload token

Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.

Browse this category

Notion integration token

Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.

Browse this category

Hard-coded credentials in a URL

Remove the embedded username:password, rotate the credential, and authenticate to the endpoint with short-lived per-user tokens instead.

Browse this category

Supabase anon key

Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.

Browse this category

Supabase service_role key (full DB access)

Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.

Hard-coded HTTP Basic credentials

Remove the hard-coded credential from the app package, rotate/revoke it immediately, and move the secret to a backend the app calls with per-user authentication.

Browse this category

Apps with mapped findings

Reset

5622 matching apps · Counts below include only this page’s mapped finding types.

Gboard - the Google Keyboard

com.google.android.inputmethod.latinBuild 18.4.1.985164140-release-arm64-v8a · 2026-10-12 09:47 UTC

1 matching category · 12 matching occurrences

A · 92/100Static analysis complete

EX File Manager

com.ace.ex.file.managerBuild 1.6.1 · 2026-10-12 09:44 UTC

2 matching categories · 2 matching occurrences

C · 73/100Static analysis complete

aCalendar - your calendar

org.withouthat.acalendarBuild 2.9.5 · 2026-10-12 09:41 UTC

1 matching category · 1 matching occurrence

A · 92/100Static analysis complete

Advanced English Dictionary

com.advanced.englishdictionary.voicetranslatorBuild 1.7.1 · 2026-10-12 09:39 UTC

1 matching category · 1 matching occurrence

A · 98/100Static analysis complete

Neshan| Map & Navigation App

org.rajman.neshan.traffic.tehran.navigatorBuild 14.13.0.6 · 2026-10-12 09:37 UTC

2 matching categories · 2 matching occurrences

C · 73/100Static analysis complete

ScanSnap Home：Scan・PDF・OCR

com.ricoh.pfu.scansnaphomeBuild 4.1.0 · 2026-10-12 09:35 UTC

2 matching categories · 3 matching occurrences

C · 74/100Static analysis complete

PowerDirector - Video Editor

com.cyberlink.powerdirector.DRA140225_01Build 16.7.2 · 2026-10-12 09:33 UTC

1 matching category · 2 matching occurrences

B · 84/100Static analysis complete

LOBSTR Vault. Multi-signature

com.lobstr.stellar.vaultBuild 3.6.5 · 2026-10-12 09:30 UTC

1 matching category · 1 matching occurrence

A · 91/100Static analysis complete

JioSphere: Web Browser

com.jio.webBuild 7.0.2 · 2026-10-12 09:27 UTC

2 matching categories · 6 matching occurrences

F · 29/100Static analysis complete

Kyte: POS System and Inventory

com.kyteBuild 4.4.1 · 2026-10-12 09:25 UTC

1 matching category · 2 matching occurrences

Limited coverageRecorded findings available · overall grade withheld

All India Warehouse

com.allindiawarehouse.appBuild 1.1.1 · 2026-10-12 09:23 UTC

1 matching category · 2 matching occurrences

A · 99/100Static analysis complete

Strava: Run, Bike, Walk

com.stravaBuild 484.10 · 2026-10-12 09:21 UTC

1 matching category · 2 matching occurrences

A · 96/100Static analysis complete

CamCard AI Scanner, Transcribe

com.intsig.BCRLiteBuild 7.89.9.20260924 · 2026-10-12 09:20 UTC

1 matching category · 3 matching occurrences

B · 77/100Static analysis complete

Shapes Fit

io.guruu.games.shapesBuild 2.4.1 · 2026-10-12 09:13 UTC

1 matching category · 2 matching occurrences

B · 89/100Static analysis complete

AudioLab Audio Cutter & Editor

com.hitrolab.audioeditorBuild 1.3.33 · 2026-10-12 09:08 UTC

1 matching category · 1 matching occurrence

A · 97/100Static analysis complete

SCRL: Photo Collage Maker

com.appostrophe.scrlBuild 1.31 · 2026-10-12 09:07 UTC

1 matching category · 1 matching occurrence

A · 92/100Static analysis complete

Game Booster: FPS Monitor RAM

io.shickshack.gamezapperBuild 2.1.55-build-20260906 · 2026-10-12 09:00 UTC

1 matching category · 1 matching occurrence

A · 99/100Static analysis complete

OneBattery: Battery Monitor

com.appcanopy.batteryvitalsBuild 3.2.0 · 2026-10-12 08:59 UTC

1 matching category · 1 matching occurrence

A · 99/100Static analysis complete

All Contacts Backup & Restore

com.call.name.anouncer.contacts.backupnumbers.messagesrecoveryBuild 3.1 · 2026-10-12 08:58 UTC

1 matching category · 1 matching occurrence

B · 86/100Static analysis complete

Heavenly Pleasures Barber Shop

com.getsquire.SquireHeavenlyPleasuresBuild 3.18-SquireHeavenlyPleasures- · 2026-10-12 08:56 UTC

1 matching category · 2 matching occurrences

A · 98/100Static analysis complete

AR Measure Tape: SmartRuler

com.lascade.measureBuild 1.2.29 · 2026-10-12 08:55 UTC

1 matching category · 1 matching occurrence

A · 98/100Static analysis complete

Qibla Finder & Qibla Direction

com.arqiblacompass.arqiblafinder.finddirection.arqibladirection.qiblalocation.qibladistanceBuild 2.1.0 · 2026-10-12 08:50 UTC

1 matching category · 2 matching occurrences

A · 97/100Static analysis complete

Trek Central

com.trekbikes.trekcentralBuild 2.11.0 b3#m-3612-g09f7d1.m-2683-g738042.m-1174-gd2791d.v0.9-327-g72b455.v1.0-333-g84ef2d · 2026-10-12 08:48 UTC

2 matching categories · 4 matching occurrences

B · 80/100Static analysis complete

HelloFresh: Meal Kit & Recipes

com.hellofresh.androidappBuild 26.41.1 · 2026-10-12 08:43 UTC

1 matching category · 1 matching occurrence

D · 40/100Static analysis complete