Hardcoded credentials
Login credentials baked permanently into an application, firmware, or device — often the same across all units and impossible for the user to change. Common and infamous in IoT devices, where a single leaked default password can compromise millions of gadgets.
Distinct from "secrets in code" (accidentally checked in) by being deliberately built in — e.g. a hidden admin account, a default password in firmware, or an API key compiled into an app. The problem: the credentials can be extracted (decompile the app, dump the firmware) and are often identical on every device → if someone finds one, ALL units are vulnerable. Infamous in IoT (cameras, routers) where the same admin/admin or a secret backdoor exists across entire product lines — the Mirai botnet was built on exactly hardcoded default credentials. Defense: force unique passwords at first boot, no hidden accounts, fetch secrets from a secure source instead of baking them in, and certificate-based authentication. Regulation (e.g. banning universal default passwords) is emerging. Related to secrets in code and passwordless auth.