Rule Definition
Hardcoded passwords in source code should be avoided because they can potentially be retrieved through code inspection and inverse engineering by attackers. Such an attack is difficult to be discovered, and eventually, the problem can only be solved at the software level thus compromising the usability of the application in the meantime.

Remediation
To remediate, try hashing the password or constructing the password string in many different places by non-trivial methods. Sensitive data such as passwords should be in principle encrypted and saved in separate files or in a database with restricted user access.

Violation Code Sample

val pwd = "WinterIsComing"

// OR
val mypwd;
mypwd = "WinterIsComing"

// OR

val myvar = "password=1234"

Fixed Code Sample

val pwd = getpasswordsafely()

__________________________

val mypwd;
mypwd = getpasswordsafely()

________________________

val pwd = "password=getpasswordsafely()"

https://cwe.mitre.org/data/definitions/259.html