Why this matters
Embedded credentials can be accidentally exposed (e.g., in public repos), compromising system security. Storing them externally and referencing them securely prevents critical data leaks.
Avoid hard‐coding credentials or sensitive information (like DB passwords, API tokens or secret keys) directly in your code. Use separate configuration files or environment variables to manage these values securely.
Embedded credentials can be accidentally exposed (e.g., in public repos), compromising system security. Storing them externally and referencing them securely prevents critical data leaks.
Side-by-side examples engineers can pattern-match during review.
<?php
$dbuser = 'admin';
$dbpass = 'secret123';
$conn = new PDO('mysql:host=localhost;dbname=test', $dbuser, $dbpass);
?><?php
$dbuser = getenv('DB_USER');
$dbpass = getenv('DB_PASS');
$conn = new PDO('mysql:host=localhost;dbname=test', $dbuser, $dbpass);
?><?php
$dbuser = 'admin';
$dbpass = 'secret123';
$conn = new PDO('mysql:host=localhost;dbname=test', $dbuser, $dbpass);
?><?php
$dbuser = getenv('DB_USER');
$dbpass = getenv('DB_PASS');
$conn = new PDO('mysql:host=localhost;dbname=test', $dbuser, $dbpass);
?>From the same buckets as this rule.