C# hardcoded OAuth client secret (ClientSecret)
Rule ID: vetkit.csharp.secrets.hardcoded-oauth-client-secret
An OAuth / OpenID Connect client secret is a string literal in source code (IdentityServer new Secret("...".Sha256()) or ClientSecret = "..."). Anyone with the code can authenticate as this client, and copies of the sample value tend to reach production.
Last updated:
Suite: Security
csharp
An OAuth / OpenID Connect client secret is a string literal in source code (IdentityServer new Secret("...".Sha256()) or ClientSecret = "..."). Anyone with the code can authenticate as this client, and copies of the sample value tend to reach production.
Category: SECURITY · Engine rule severity: WARNING
How to fix it
Read the secret from configuration backed by a secret store (Key Vault, environment variables, user-secrets) and register IdentityServer clients from configuration or a database; rotate the exposed value.
References
Source: packages/engine/rules/sast/csharp.yml.
Related checks
Check your own repository for this
vetkit runs this rule as part of a repository audit, alongside secret scanning, dependency vulnerabilities, code quality and AI code risk checks. It reads a temporary checkout and never executes your code.
Start with the free Security Quick Scan · See how the platform works
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.