Description

Detects hardcoded credentials like JWT tokens exposed directly in Kotlin source code. This is a security risk since hardcoded secrets can be extracted from the application code and potentially used to gain unauthorized access.

Detection Strategy

• Scans Kotlin source code files for string literals and variable assignments

• Identifies patterns that match credential formats like JWT tokens (base64 encoded strings with specific structure)

• Reports a vulnerability when credentials or secrets are found directly embedded in the code rather than loaded from secure configuration

Vulnerable code example

import com.auth0.jwt.JWT
import com.auth0.jwt.algorithms.Algorithm
import java.security.interfaces.RSAPublicKey

fun verifyToken(token: String) {
    val publicKey: RSAPublicKey = getPublicKey()
    // VULNERABLE: Using only public key for RSA verification enables signature stripping attacks
    val algorithm = Algorithm.RSA256(publicKey, null)...

✅ Secure code example

import com.auth0.jwt.JWT
import com.auth0.jwt.algorithms.Algorithm
import java.security.interfaces.*

fun verifyToken(token: String) {
    try {
        val publicKey: RSAPublicKey = getPublicKey() 
        val privateKey: RSAPrivateKey = getPrivateKey()...