Amazon Q
Detector Library
PHP detectors (37/37)
Server Side Request ForgerySQL InjectionActivated Debug FeatureSensitive information leakLog InjectionMissing AuthorizationOrigins-verified cross-origin communicationsCross-site scriptingPath TraversalAvoiding Exceptions in PHPOS command injectionIncorrect ComparisonLdap Bind Without PasswordSendfile InjectionInteger Overflow or WraparoundAssert UseLoose file permissionsHardcoded credentialsImproper AuthenticationInsecure connectionWeak Random Number GenerationOpen RedirectAllow Url Fopen Or IncludeInsecure cryptographyObject Input Stream Insecure DeserializationCookie Without Http Only FlagCode InjectionZip bomb attackUnsafe ReflectionSecure Signal HandlingDeserialization of untrusted dataUnrestricted File UploadStatic Initialization Vector (IV)Coral Csrf RuleInsecure cookieImproper access controlInsecure Object Attribute Modification
Hardcoded credentials Critical
Access credentials, such as passwords and access keys, should not be hardcoded in source code. Hardcoding credentials may cause leaks even after removing them. This is because version control systems might retain older versions of the code. Credentials should be stored securely and obtained from the runtime environment.
Detector ID
php/hardcoded-credentials@v1.0
Category
Common Weakness Enumeration (CWE) 
Noncompliant example
1function nonCompliant() {
2 // NonCompliant: Stored passwords directly in the code statement
3 $password = "3xAmpl3";
4 return KeyOrPassword::createFromPassword($password);
5}
Compliant example
1function compliant() {
2 // Compliant: Access sensitive information like passwords directly from environment variables
3 $password = $_ENV["SECRET"];
4 return KeyOrPassword::createFromPassword($password);
5}