Skip to main content

SQ34301

Detected presence of placeholder credentials within network protocol strings.

priorityCI/CD statusseverityeffortSAFE levelSAFE assessment
NonepasslowlowNoneNone

About the issue​

Various network communication protocols allow including plaintext authentication credentials. This policy control matches the following URI pattern protocol://username:password@domain within any software package component. Some matched network credentials may refer to placeholder values that get programmatically filled during runtime as the software executes. Placeholder values are considered safe and are purposefully suppressed as informational warnings. The list of allowed placeholder values can be declared through policy configuration and other related settings.

How to resolve the issue​

  • Review the reported matches.
  • If the warning does not refer to a placeholder value revoke the exposed credentials and file a security incident.

Incidence statistics​

ReversingLabs periodically collects and analyzes the contents of popular software package repositories for threat research purposes. Analysis results are used to calculate incidence statistics for issues (policy violations) that Spectra Assure can detect in software packages.

This section is updated when new data becomes available.

Total amount of packages analyzed

  • Linux: 562K
  • NPM: 5.12M
  • Nuget: 735K
  • PS Gallery: 17K
  • PyPi: 838K
  • RubyGems: 203K
  • VS Code: 113K
  • Windows: 3.7K
Statistics are not collected for the SQ34301 policy at this time, or not applicable to this type of issue.