What is Use of Hard-coded, Security-relevant (CWE-547)?

TL;DR: Use of Hard-coded, Security-relevant Constants (CWE-547) is a security misconfiguration where critical values are hardcoded. It increases maintenance risks and should be avoided in favor of externalized configurations.

What is Use of Hard-coded, Security-relevant Constants?

Use of Hard-coded, Security-relevant Constants (CWE-547) is a type of security misconfiguration where critical values are hardcoded in the source code instead of being externalized or dynamically loaded from configuration files. As defined by the MITRE Corporation under CWE-547 and classified by the OWASP Foundation under A02:2025 - Security Misconfiguration, this vulnerability increases the likelihood of mistakes during code maintenance and makes it difficult to update security policies.

Quick Summary

Use of Hard-coded, Security-relevant Constants is a significant risk because it reduces maintainability and quality. It can lead to unexpected behavior and vulnerabilities when critical values need updating or changes are made to the system’s configuration. Jump to: Overview · How It Works · Business Impact · Attack Scenario · Detection · Fixes

Jump to: Quick Summary · Use of Hard-coded, Security-relevant Constants Overview · How Use of Hard-coded, Security-relevant Constants Works · Business Impact of Use of Hard-coded, Security-relevant Constants · Use of Hard-coded, Security-relevant Constants Attack Scenario · How to Detect Use of Hard-coded, Security-relevant Constants · How to Fix Use of Hard-coded, Security-relevant Constants · Framework-Specific Fixes for Use of Hard-coded, Security-relevant Constants · How to Ask AI to Check Your Code for Use of Hard-coded, Security-relevant Constants · Use of Hard-coded, Security-relevant Constants Best Practices Checklist · Use of Hard-coded, Security-relevant Constants FAQ · Vulnerabilities Related to Use of Hard-coded, Security-relevant Constants · References · Scan Your Own Site

Use of Hard-coded, Security-relevant Constants Overview

What

Use of Hard-coded, Security-relevant Constants occurs when security-critical values are hardcoded in the source code instead of being externalized or dynamically loaded from configuration files.

Why it matters

Hardcoded constants increase maintenance risks and make it difficult to update security policies. They can lead to quality degradation and reduced maintainability.

Where it occurs

This vulnerability is common in any application that uses hard-coded values for security-relevant configurations, such as API keys or database credentials.

Who is affected

Developers and organizations that rely on hardcoded constants for critical settings are at risk of this issue.

Who is NOT affected

Applications that externalize these values through configuration files or environment variables are not vulnerable to this weakness.

How Use of Hard-coded, Security-relevant Constants Works

Root Cause

The root cause lies in the use of hard-coded security-relevant constants instead of symbolic names or configurable settings. This practice increases maintenance risks and makes it difficult to update security policies.

Attack Flow

1. An attacker identifies hardcoded critical values within the application.
2. The attacker exploits these values by modifying them, leading to potential security vulnerabilities.

Prerequisites to Exploit

• The presence of hard-coded constants in the source code.
• Access to modify or view the source code.

Vulnerable Code

API_KEY = 'hardcoded_api_key'
DATABASE_PASSWORD = 'hardcoded_password'

This code is vulnerable because critical security values are hardcoded, making it difficult to update them securely.

Secure Code

from configparser import ConfigParser

config = ConfigParser()
config.read('settings.ini')
API_KEY = config.get('security', 'api_key')
DATABASE_PASSWORD = config.get('database', 'password')

This code is secure because security-relevant values are externalized in a configuration file, making it easier to manage and update them.

Business Impact of Use of Hard-coded, Security-relevant Constants

Confidentiality

• Exposed API keys or sensitive data can be leaked.

Integrity

• Incorrect updates to hardcoded constants may lead to unexpected behavior.

Availability

• Changes in security policies cannot be easily applied without modifying the source code.

Financial

• Potential legal and financial penalties due to data breaches caused by misconfigurations.

Use of Hard-coded, Security-relevant Constants Attack Scenario

1. An attacker identifies a hard-coded API key within the application.
2. The attacker uses this key to gain unauthorized access to sensitive resources.
3. The attacker exploits the system’s vulnerabilities by modifying hardcoded constants.

How to Detect Use of Hard-coded, Security-relevant Constants

Manual Testing

• Review source code for hardcoded security-relevant values.
• Check configuration files and environment variables for externalized settings.

Automated Scanners (SAST / DAST)

Static analysis tools can detect hard-coded constants, while dynamic scanners might miss them if they are not exposed during runtime.

PenScan Detection

PenScan’s ZAP and Nuclei engines actively scan for hardcoded security-relevant constants in source code.

False Positive Guidance

A real finding will show actual hardcoded values that should be externalized. A false positive may occur when a constant is used but correctly managed through configuration files or environment variables.

How to Fix Use of Hard-coded, Security-relevant Constants

• Avoid using hard-coded constants.
• Externalize security-relevant values in configuration files or environment variables.

Framework-Specific Fixes for Use of Hard-coded, Security-relevant Constants

Python/Django

from configparser import ConfigParser

config = ConfigParser()
config.read('settings.ini')
API_KEY = config.get('security', 'api_key')
DATABASE_PASSWORD = config.get('database', 'password')

How to Ask AI to Check Your Code for Use of Hard-coded, Security-relevant Constants

Use of Hard-coded, Security-relevant Constants Best Practices Checklist

✅ Avoid hard-coding security-relevant values in source code. ✅ Externalize critical constants to configuration files or environment variables. ✅ Regularly review and update externalized configurations.

Use of Hard-coded, Security-relevant Constants FAQ

How can I identify hard-coded security constants in my code?

Look for literal values that should be configurable or externalized, such as API keys, database credentials, or security thresholds.

Why is using hard-coded constants a security risk?

Hard-coded constants make it difficult to update security policies and increase the likelihood of mistakes during maintenance.

How do I prevent CWE-547 in my application code?

Avoid hard-coding security-relevant values by storing them in configuration files or environment variables instead.

What are some common examples of hard-coded constants?

Common examples include API keys, database connection strings, and security thresholds like session timeouts.

How can I detect hard-coded security constants using automated tools?

Use static analysis tools to scan for literals that should be externalized or dynamically loaded from configuration files.

What are the business impacts of CWE-547?

Hard-coded constants can lead to quality degradation, reduced maintainability, and potential security vulnerabilities during maintenance.

How does OWASP categorize this issue?

This issue is categorized under A02:2025 - Security Misconfiguration in the OWASP Top Ten.

Vulnerabilities Related to Use of Hard-coded, Security-relevant Constants

References

• MITRE - CWE-547
• OWASP Top Ten 2025 - A02: Security Misconfiguration
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Use of Hard-coded, Security-relevant Constants and other risks before an attacker does.