Is a hard-coded credential still a problem if it's in a demo file?

Yes. Scanners can't distinguish a demo key from a live one, and a real-looking value in a seed or example file gets harvested like any other. Treat every credential-shaped value as live.

Does CWE-798 only apply to passwords?

No. It covers any embedded credential — API keys, tokens, private keys, connection strings — not just passwords.

How does EnvLens help with CWE-798?

EnvLens flags credential-shaped values in your config, classifies them by weakness type (CWE-798/259/312), and gives a prioritized remediation checklist.

Is fixing CWE-798 the same as being secure?

No. Removing hard-coded credentials closes one high-severity weakness; it does not make the whole system secure. Insecure settings and other paths remain.

Is EnvLens a penetration test or a guarantee?

No. EnvLens is a config scanner for exposed secrets and insecure settings. It is decision-support, not a penetration test, an audit, or a guarantee of a breach-free system.

CWE-798: hard-coded credentials explained

---

What CWE-798 covers

CWE-798 is the Common Weakness Enumeration entry for "Use of Hard-coded Credentials" — a password, key, or token written directly into source or config instead of being supplied at runtime. It is one of the most prevalent and most exploited weakness classes because the fix is simple to skip and the consequence is direct account takeover.

Why it is high priority

A hard-coded credential is, by definition, recoverable by anyone who can read the artifact: a repo collaborator, a fork owner, or a scanner that finds the public repo. There is no rotation boundary and no secret boundary. CWE-798 pairs naturally with CWE-259 (hard-coded password) and CWE-312 (cleartext storage), and maps to OWASP Top 10 A07 (Identification and Authentication Failures).

Where they hide

They are not always in prod.config. They show up in test fixtures, seed scripts, example .env.sample files, and "temporary" debug blocks. Because they look like demos, teams leave them in — but a real-looking key in a seed file is harvested exactly like a live one. EnvLens maps each finding to its weakness type so you can triage by severity.

Mapping findings to weakness types

A good scan does more than say "secret found." It classifies: is this a hard-coded credential (CWE-798), a cleartext storage issue (CWE-312), or an insecure setting (debug=true, wildcard CORS)? The weakness type tells you the right remediation, not just the symptom. That mapping is what turns a raw find into a tracked fix.

Beyond CWE-798

CWE-798 is the headline, but insecure config is broader: disabled TLS, verbose debug in production, permissive CORS, missing security headers. EnvLens reports these alongside secrets so the gap list is complete, not just credential-shaped.

Authoritative references

CWE-798 (Hard-coded credentials): https://cwe.mitre.org/data/definitions/798.html
CWE-259 (Use of hard-coded password): https://cwe.mitre.org/data/definitions/259.html
OWASP Top 10 (A07): https://owasp.org/Top10/