AGENTFORCE-SEC-06: Hard-coded Authorization Header in Apex
🔴 High · Credential Exposure
Detects Apex callouts that set an Authorization (Basic / Bearer) or API-key header to a value fixed in code: a literal, constants, or base64 of a hard-coded user:password. Named Credential merge fields ({!$Credential...}) and values from parameters, settings or labels are not reported.
Details
| Field | Value |
|---|---|
| Rule ID | AGENTFORCE-SEC-06 |
| Severity | High |
| Category | Credential Exposure |
| Compliance | SOC2_CC6, PCI_DSS |
Remediation
Move the credential to a Named Credential with an External Credential (Basic, OAuth or custom header principal) and call 'callout:<Name>'; Salesforce then adds the Authorization header. Rotate the exposed credential.