For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/security/code_security/static_analysis/static_analysis_rules/dart-security/hardcoded-credentials.md. A documentation index is available at /llms.txt.

Avoid hardcoding credentials in source code

This product is not supported for your selected Datadog site. ().

Metadata

ID: dart-security/hardcoded-credentials

Language: Dart

Severity: Error

Category: Security

CWE: 798

Description

Hardcoding credentials such as passwords, API keys, tokens, or secrets as string literals exposes them to anyone with access to the source code or the compiled application. Secrets embedded in code are trivially extracted from compiled apps and leak through version control history, where they remain even after being removed.

Load credentials at runtime from environment variables or a secrets manager instead of writing them directly into the code.

Non-Compliant Code Examples

class Service {
  final password = 'hunter2';
  var apiKey = 'AKIAIOSFODNN7EXAMPLE';
  String secret = 'xyz';
}

void sendCredentials() {
  connect(password: 'hunter2');
  buildClient(apiKey: 'sk-test-1234567890');
}

void connect({String? password}) {}
void buildClient({String? apiKey}) {}

Compliant Code Examples

import 'dart:io';

class Config {
  final String password = Platform.environment['DB_PASSWORD']!;
  final apiKey = const String.fromEnvironment('API_KEY');
  final token = readSecret();
  final secret = otherVar;
}

String readSecret() => Platform.environment['SECRET']!;

void nonCredentialNames() {
  final username = 'admin';
  final name = 'bob';
  final displayLabel = 'Sign in';
  final password = '';
  final apiKey = "";
}

void interpolated(String base) {
  final password = '$base-suffix';
  final token = "Bearer ${base}";
  connect(secret: 'prefix_$base');
}

void connect({String? secret}) {}
https://static.datadoghq.com/static/images/logos/github_avatar.svg https://static.datadoghq.com/static/images/logos/vscode_avatar.svg jetbrains

Seamless integrations. Try Datadog Code Security