Named Credentials

Vulkro checks every *.namedCredential-meta.xml (SFDX) and *.namedCredential (MDAPI) file, plus the per-user mapping files beside them. No flag is needed. Four checks run on the metadata.

Hardcoded password (Critical)

<NamedCredential>
    <endpoint>https://api.example.com</endpoint>
    <password>Sup3rS3cret-committed</password>
</NamedCredential>

A <password> in deployable metadata ships the credential to every target org. Fix: remove it and set the credential in the target org's Setup after deploy, or use an External Credential that an admin fills in at install.

Cleartext endpoint (High)

<endpoint>http://legacy.example.com/api</endpoint>

Every callout, and any credential attached to it, travels unencrypted. Fix: use https://.

allowMergeFieldsInBody=true (Medium)

<allowMergeFieldsInBody>true</allowMergeFieldsInBody>

Merge expressions are interpolated into every callout body. If a merge value can be influenced by a user, this becomes template injection (CWE-1336). The platform default, false, is safe. Fix: set it to false and build callout bodies in Apex with explicit encoding.

Anonymous principal with a hardcoded credential (High)

<NamedCredential>
    <principalType>AnonymousUser</principalType>
    <protocol>Password</protocol>
    <username>service-account</username>
    <password>baked-in-secret</password>
</NamedCredential>

An anonymous principal with a baked-in password leaks one shared secret to every org. Fix: remove the credential (truly anonymous), or switch <principalType> to NamedUser and set the secret in Setup.

External Credentials

A secret-like parameter value hardcoded in an *.externalCredential-meta.xml file is reported as externalcredential-hardcoded-secret (Critical).

Not covered yet

• Settings made only in Setup, not in metadata. The live-org audit vulkro-sf org named-credentials checks the org's live Named Credentials.
• A secret stored only in a per-user mapping file is checked by the anonymous-principal rule, not by a rule of its own.

See also: Connected Apps, org named-credentials