ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question

Hardcoding secrets in source code violates least-privilege and creates a high risk of credential exposure through repository access, logs, or backups. The recommended practice is to remove the secret from code entirely and retrieve it at runtime from a dedicated secrets-management service (for example, a vault) that authenticates the workload through a managed identity or similar mechanism. Base64 encoding only obscures the value without securing it. Storing the password in a separate, ignored file still bakes it into container images and does not control access centrally. Forcing regular password changes while keeping it in code simply repeats the same insecure pattern every month.