Rule Definition
Storing passwords in comments is almost equivalent to hard-coding them. Anyone with access to the code will be able to get the password and may misuse it. It bodes danger to the security and availability of a system.
Remediation
Ensure to not store passwords in comments
Violation Code Sample
//AH.Password = ""***********"";
...
//string CarZonRentPassword = ""**********"";
...
//objAuth.Password = ""dV5wtiUUUTnN:sR678"";
...
//strConnectionString = ""Data Source=10.200.114.176;Initial Catalog=2221_Etravel_3.0;User
ID=tms_Appuser;Password=**********;Max Pool Size=1000"";
Reference
CWE - 615
https://cwe.mitre.org/data/definitions/615.html
Related Technologies
Technical Criterion
Secure Coding - API Abuse
About CAST Appmarq
CAST Appmarq is by far the biggest repository of data about real IT systems. It's built on thousands of analyzed applications, made of 35 different technologies, by over 300 business organizations across major verticals. It provides IT Leaders with factual key analytics to let them know if their applications are on track.