Hardcoding and Configuration
Detects hardcoded IPs, URLs, connection strings, secrets, and environment names committed to source.
Why this rule exists
Secrets in source code leak through forks, mirrors, search indexes, and logs. Hardcoded environment URLs cause prod traffic to hit staging the moment a config flag flips wrong.
Code example
+ var conn = "Server=10.0.0.5;Database=Prod;User Id=admin;Password=hunter2";+ var conn = _config.GetConnectionString("Orders")
+ ?? throw new InvalidOperationException("Orders connection string missing");Configuration
Disable or adjust the severity of this rule in .gauntletci.json:
{
"rules": {
"GCI0010": { "enabled": true, "severity": "Block" }
}
}See Configuration for the full schema.
Related rules
Security Risk
Detects SQL injection patterns, weak crypto algorithms (MD5, SHA1, DES), dangerous APIs (Assembly.Load, Process.Start), and credential exposure.
Insecure Random in Security Context
Detects System.Random instantiation within 5 lines of security-sensitive identifiers such as token, apikey, salt, or password. System.Random is not cryptographically secure.
Discussed in
Implemented in src/GauntletCI.Core/Rules/Implementations/GCI0010_*.cs.
Eric Cogen -- Founder, GauntletCI
Twenty years as a senior technical consultant building and modernizing enterprise platforms across .NET, AWS, serverless, microservices, and AI-driven systems.