M1:2024: Improper Credential Usage
Hardcoded API keys, tokens, or credentials embedded in the app binary or config, plus insecure handling of credentials at runtime (logging, caching, or storing them insecurely on the device).
How it's found
Identified through static and binary inspection for hardcoded API keys and credentials embedded in the app package.
Vulnerable vs. safe
val apiKey = "sk_live_51H8x..." // hardcoded in sourceval apiKey = BuildConfig.API_KEY // injected at build time from a secrets store, never committedStandards mapping
How TurboPentest tests for this (white-box)
This weakness (Use of Hard-coded Credentials) is caught by white-box static analysis when you connect a GitHub repo: IntegSec's Opengrep SAST rule pack carries 63 rules for it, flagging the issue directly in your source code as part of the pentest.
Frequently asked questions
What is M1:2024 Improper Credential Usage?
Hardcoded API keys, tokens, or credentials embedded in the app binary or config, plus insecure handling of credentials at runtime (logging, caching, or storing them insecurely on the device).
How do you find Improper Credential Usage?
Identified through static and binary inspection for hardcoded API keys and credentials embedded in the app package.
Which CWEs map to M1:2024?
M1:2024 maps to CWE-798, CWE-522.
Does TurboPentest test for Improper Credential Usage?
This weakness (Use of Hard-coded Credentials) is caught by white-box static analysis when you connect a GitHub repo: IntegSec's Opengrep SAST rule pack carries 63 rules for it, flagging the issue directly in your source code as part of the pentest.
Related OWASP categories
- OWASP Mobile Top 10M2:2024: Inadequate Supply Chain Security
- OWASP Mobile Top 10M3:2024: Insecure Authentication/Authorization
- OWASP Mobile Top 10M4:2024: Insufficient Input/Output Validation
- OWASP Mobile Top 10M5:2024: Insecure Communication
- OWASP Mobile Top 10M6:2024: Inadequate Privacy Controls
- OWASP Mobile Top 10M7:2024: Insufficient Binary Protections
Written and reviewed by
Michel Chamberland - Founder & CEO, IntegSec
CISSP, OSCP, OSCE, CEH, GIAC, CCSK · 20+ years in offensive security
Michel has spent 20+ years on offensive security teams including IBM X-Force Red and Trustwave SpiderLabs, leading penetration tests, red team engagements, and breach response for Fortune 500 customers. He is the founder of IntegSec and the architect of TurboPentest.
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a pentest