Description

This detector identifies hardcoded passwords in Go applications using RabbitMQ AMQP connections. It specifically targets AMQP dial functions where credentials are embedded directly in the source code instead of being retrieved from secure configuration sources, creating a significant security risk as passwords become visible to anyone with code access.

Detection Strategy

• The application must import the RabbitMQ AMQP library (github.com/rabbitmq/amqp091-go)

• Code contains calls to AMQP connection functions like amqp.Dial, amqp.DialTLS, or amqp.DialConfig

• For amqp.Dial and amqp.DialTLS: The connection string parameter uses sprintf-style formatting that includes hardcoded credentials

• For amqp.DialConfig: The SASL authentication configuration contains a hardcoded password value

• The password values are literal strings in the source code rather than variables, environment variables, or configuration references

Vulnerable code example

package main

import (
	"fmt"
	amqp "github.com/rabbitmq/amqp091-go"
)

func connectToRabbitMQ() (*amqp.Connection, error) {...

✅ Secure code example

package main

import (
	"fmt"
	"os"
	amqp "github.com/rabbitmq/amqp091-go"
)
...