AZR002 — azure-hardcoded-secret

Severity: blocker · Category: Azure Pipelines

What it checks

Flags a task's inputs: or env: value where the key looks like a credential (matches password, secret, token, api[_-]?key, or access[_-]?key, case-insensitive) and the value is a literal string rather than a $(variableName) reference into an Azure Pipelines variable, variable group, or Key Vault-linked secret.

Why it matters

Same risk as SEC002's GitHub Actions equivalent, expressed in Azure's own variable syntax: anything committed to a pipeline YAML file is visible to anyone with read access to the repository, including its full git history. Azure Pipelines' variable system (plain variables, variable groups, and Key Vault-linked secret variables) exists specifically so credentials never need to appear as plaintext in the file.

Examples

Flagged:

- task: AzureCLI@2
  inputs:
    azureSubscription: "my-sub"
    scriptType: bash
    scriptLocation: inlineScript
    inlineScript: az account show
  env:
    AZURE_API_KEY: sk_live_51H8x9K2mN7qR3vW

Fixed — referencing a pipeline variable (backed by a variable group or Key Vault, not a plaintext default):

- task: AzureCLI@2
  inputs:
    azureSubscription: "my-sub"
    scriptType: bash
    scriptLocation: inlineScript
    inlineScript: az account show
  env:
    AZURE_API_KEY: $(azureApiKey)

If the credential was genuinely committed (not a fixture/test value), rotating it is the only real fix — deleting the line doesn't remove it from git history.

Suppressing

The finding is reported on the step's own line:

- task: AzureCLI@2 # vlotpipe: ignore[AZR002]
  inputs:
    azureSubscription: "my-sub"
  env:
    AZURE_API_KEY: sk_test_not_a_real_key

Reasonable for genuinely fake test/example credentials — otherwise this should never be suppressed without rotating the leaked value first.