Description

This detector identifies hardcoded Redis passwords in Go applications using the redis/go-redis library. It finds credentials that are directly embedded in source code rather than retrieved from secure configuration sources, which creates security risks if the code is exposed or stored in version control systems.

Detection Strategy

• The Go application must import the redis/go-redis library (github.com/redis/go-redis package)

• Detection triggers when redis.ParseURL() is called with a connection string containing embedded credentials in sprintf format

• Detection also triggers when Redis client constructors or connection methods are called with hardcoded password parameters

• The detector specifically looks for password values that appear to be literal strings rather than variables loaded from configuration

Vulnerable code example

package main

import (
	"github.com/redis/go-redis/v9"
)

func main() {
	// Hardcoded password in Redis client - security risk...

✅ Secure code example

package main

import (
	"os"

	"github.com/redis/go-redis/v9"
)
...