Credentials compared in browser code
Scan rule · RSC-SEC-036
- Security
- Severity: Critical
- CWE-798
- OWASP A07-2021
Finds comparisons such as `password === "…"` against a fixed literal in shipped code.
Why this matters
A password compared in browser code is not protection but a screen: the value sits in the shipped JavaScript and is readable with dev tools in seconds.
Such checks appear as a shortcut — “just for the prototype, so the demo isn't wide open” — and then stay, because they work. To the operator the site looks protected, and that is exactly the problem.
Fix: move access behind a real sign-in with a server-side check, and treat the previous value as compromised — it was public for as long as the page was reachable.
Scan tier
- External scan (anonymous)
How to fix it
Perform the access check server-side (e.g. Supabase Auth) and treat the discovered password as compromised.