The warning you're seeing about the use of hard-coded credentials is a security concern, as it can potentially expose sensitive information in your code. To resolve this issue in your Node.js project, you should follow best practices for handling credentials and secrets securely. Here are some steps you can take:

Use Environment Variables:

Store sensitive information like usernames and passwords in environment variables. This way, they won't be hard-coded in your codebase.

Use a Configuration File:

Create a configuration file (e.g., config.js) where you can store environment-specific settings and secrets. This file can read environment variables and provide them as configuration options to your application.

Use a Secrets Management Service:

Consider using a secrets management service like HashiCorp Vault or AWS Secrets Manager to securely store and retrieve sensitive information.

Use .env Files:

You can use a .env file to set environment variables locally during development. Tools like dotenv can help you load these variables into your Node.js application.

Implement Authentication and Authorization:

For authentication purposes, consider using token-based authentication (e.g., JWT) instead of hard-coded credentials.

Implement proper authorization checks to ensure that users have the appropriate permissions to access resources.

Encrypt Sensitive Data:

If you need to store sensitive data in your database, ensure that it is encrypted both at rest and in transit.

Test with Mock Data:

During testing, use mock data or test accounts specifically created for testing purposes rather than using real credentials.

Code Review and Static Analysis:

Continuously review your codebase for any instances of hard-coded credentials. Tools like ESLint with appropriate plugins can help identify and fix such issues during development.

Educate the Team:

Ensure that your development team is aware of the importance of not hard-coding credentials and follows best practices for handling sensitive information.

Regularly Update Secrets:

Rotate credentials and Military Star Card Login secrets periodically to reduce the potential impact of a security breach.

By following these best practices, you can significantly improve the security of your Node.js application and address the issue of hard-coded credentials. Always prioritize security when developing and maintaining your software.

With the July and August updates to Veracode Static Analysis, Veracode has improved our ability to find hardcoded credentials.

Please note however, that unfortunately, unlike most other flaws in Veracode Static Analysis, this flaw is more prone to false positives as it relies on heuristics rather than data flow.

Please ensure you've scanned recently (to have the benefits of our latest updates) but if you encounter something that is not a password we recommend documenting that in a mitigation proposal: https://docs.veracode.com/r/improve_mitigation and then contacting your organizations security team to request a review.

If you're not sure I would recommend you schedule a consultation call to discuss.

You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.

Thank you,

Boy Baukema

Ah, one more thing, for NodeJS specifically, we frequently see testcases being uploaded as part of the application. We recommend you strip these from your upload.

One of my colleagues has created a packaging tool that will attempt to do so automatically, you can find that at: https://github.com/dub-flow/veracode-javascript-packager .

Thank you,

Boy Baukema