Description

Detects hardcoded symmetric cryptographic keys used with SymmetricSecurityKey in C# code. This is a security risk because hardcoding cryptographic keys in source code makes them easily discoverable and prevents key rotation, potentially leading to compromised encryption.

Detection Strategy

• Look for instantiations of SymmetricSecurityKey class (including various namespace variations)

• Check if the first constructor argument (the key material) is a hardcoded string value

• Report a vulnerability if a SymmetricSecurityKey is created with a hardcoded key rather than retrieving it from secure configuration or key management systems

Vulnerable code example

using Microsoft.IdentityModel.Tokens;
using System.Text;

public class TokenGenerator
{
    public SigningCredentials CreateCredentials()
    {
        var secretKey = "hardcoded_secret_1234";  // Vulnerable: Hardcoded secret key...

✅ Secure code example

using Microsoft.IdentityModel.Tokens;
using System.Security.Cryptography;

public class TokenGenerator
{
    public SigningCredentials CreateCredentials()
    {
        byte[] keyBytes = new byte[32]; // 256-bit key...