HardcodedCredentialAtKnownSink

warning native off by default

Group: Security

Literal credentials embedded in connection setup are difficult to rotate and protect. Load them from the application's external configuration. This inspection is disabled by default because the intended policy or use can vary.

Example

<?php
new PDO($dsn,"service","permanent-password");

Reported:

• line 2: Load credentials from external configuration.

Detection

• Resolved PDO constructor password or mysqli connection password is a nonempty literal string. Inspection is disabled by default and excludes configured example/test path glob list, default /testdata/ and /tests/; no arbitrary password variable naming heuristics.
• Resolve builtin functions, classes, constants and methods; user-defined lookalikes are excluded. Follow only bounded local proof in one lexical scope.
• D1a. The excluded-path globs are matched against the file path relative to its project root, with forward slashes. The project root is the nearest ancestor directory holding custos.json; without one, the outermost ancestor holding composer.json, so that a package or fixture application nested in the project (tests/fixtures/app/composer.json) stays part of it; without either, the working directory. A file outside that root is matched by its absolute path. The outcome therefore does not depend on the directory custos is started from, and a directory named tests or testdata above the project root does not exclude the project.
• Emit one finding per violating operation, not per supporting evidence statement. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Do not report unresolved or shadowed builtin names, unknown values, or incomplete receiver/type provenance. Unknown calls, aliases escaping, and intervening writes invalidate local proof. Similar code outside the stated detection contract is not a finding.
• Do not report a file whose project-relative path (D1a) matches an excludedPaths glob. ** matches any number of path segments; other segments use shell-style matching. Invalid globs and paths or patterns beyond the segment budget match nothing.
• Both standard suppression forms suppress this native ID.

Fix

None. Choosing a repair requires intent or additional runtime information.

PHP versions

Available throughout supported PHP 5.3–8.5 where the referenced builtin/extension is available. Respect syntax/version-specific receiver contracts; unavailable APIs are not this rule’s concern.

Options

Option	Type	Default	Effect
excludedPaths	list	["**/testdata/**", "**/tests/**"]	Project-relative path globs for files that are never reported.

Configure

In custos.json:

{
  "rules": {
    "HardcodedCredentialAtKnownSink": {
      "enabled": true,
      "options": {
        "excludedPaths": ["**/testdata/**","**/tests/**"]
      }
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore HardcodedCredentialAtKnownSink