Apps with hard-coded usernames and passwords

What this finding means

This category is narrower than a leaked API key and usually worse. It covers a username and password compiled into the app: a URL written as https://user:password@host/path, or an Authorization header built from a Base64-encoded credential pair.

We have recorded this in 89 apps. Base64 is an encoding, not encryption; recovering the password from the header is a single decode step.

Where an API key is typically scoped to one service and designed to be revocable, a credential pair is a login to an account. It often carries whatever that account can do, which is frequently more than the app needs.

Why a credential in a URL is worse than one in a header

A password placed in a URL escapes the request. URLs are written to server access logs, proxy logs and reverse-proxy traces; they appear in Referer headers sent to third parties, in browser and CLI history, and in crash and analytics payloads that capture the failing request.

That means the password is not only in the APK. It has probably been copied into systems you do not control and cannot clean, which changes remediation: rotation is mandatory rather than precautionary.

How to fix it

• Rotate the credential first. It should be considered public from the moment it shipped, and no obfuscation changes that.
• Replace shared credentials with per-device or per-user tokens obtained at runtime, so a compromise is revocable for one client rather than all of them.
• If a backend genuinely requires Basic auth, terminate it on a server you control and have the app authenticate to that server instead.
• Never carry credentials in the URL. If a credential must be sent, put it in a header over TLS.
• Check who else uses the account before rotating: a shared service account is why these persist, and an uncoordinated rotation breaks something else.

How we detect it, and what we store

The URL-embedded form and the Basic authorization header form are matched structurally, and the Basic header is decoded only far enough to confirm it carries a credential pair rather than something else.

The value itself is never stored. What is recorded is the scheme prefix, a coarse length bucket and a non-reversible fingerprint — enough to deduplicate the finding and to recognise the same artifact across apps, and not enough to reconstruct the password from anything we publish.