Description

This detector identifies hardcoded private keys in C# code that uses the `System.Security.Cryptography` namespace. Embedding cryptographic private keys directly in source code exposes sensitive key material to anyone with access to the codebase, version control history, or compiled binaries, potentially allowing attackers to decrypt data, forge signatures, or impersonate services.

Detection Strategy

• The detector only activates when the `System.Security.Cryptography` namespace is imported in the file being analyzed, ensuring it focuses exclusively on code using .NET cryptographic APIs.

• Within files that import the cryptography namespace, the detector inspects selected code expressions or statements to determine whether a private key value is being assigned or initialized as a hardcoded literal (e.g., a string or byte array constant) rather than being loaded from a secure external source such as a key store, environment variable, or configuration file.

• A vulnerability is reported when a cryptographic object or method parameter associated with private key usage receives a hardcoded value directly in the source code, flagging the specific location where the insecure key material appears.

Vulnerable code example

using System;
using System.Security.Cryptography;

public class HardcodedPrivateKey
{
    // UNSAFE: RSA private key PEM literal embedded directly in source
    public static byte[] Sign(byte[] data)
    {...

✅ Secure code example

using System;
using System.Security.Cryptography;
using Microsoft.Extensions.Configuration;

public class HardcodedPrivateKey
{
    private readonly IConfiguration _config;
...