SEC014 — hardcoded-container-credentials

Severity: blocker · Category: Security

What it checks

Flags a container: or services.<name>: block whose credentials.password is a literal string rather than a ${{ secrets.* }} expression.

Why it matters

Container registry credentials hardcoded in a workflow file are exactly as exposed as any other hardcoded secret (see SEC002) — visible to anyone with read access to the repo, including its history, indefinitely.

Examples

Flagged:

jobs:
  test:
    runs-on: ubuntu-latest
    container:
      image: registry.example.com/build-image
      credentials:
        username: ci-bot
        password: hunter2
    steps:
      - run: make test

Fixed:

jobs:
  test:
    runs-on: ubuntu-latest
    container:
      image: registry.example.com/build-image
      credentials:
        username: ci-bot
        password: ${{ secrets.REGISTRY_PASSWORD }}
    steps:
      - run: make test

Suppressing

The finding is reported on the container block's first key (image:), not the container: key or the password: line itself:

    container:
      image: registry.example.com/build-image # vlotpipe: ignore[SEC014]
      credentials:
        username: ci-bot
        password: hunter2

Should essentially never be suppressed — rotate the credential and use a secret reference instead.