CVE-2026-103096

Authenticator management requires secure distribution and handling of credentials, structurally discouraging hard-coded values.

Developer testing and static analysis locate hard-coded sensitive values before code is deployed.

Engineering principles require secrets to be externalized rather than embedded in source.

Cryptographic key management mandates proper establishment and handling instead of embedding keys in code.

SC-28 requires cryptographic or equivalent protection of sensitive data at rest, directly stopping cleartext storage in accessible resources.

PR.AA-01's credential/key-management processes can reduce the incentive to embed secrets but do not address or detect hard-coded values in source code, so the weakness remains fully possible.

Encryption and cryptographic controls for data-at-rest directly prevent cleartext storage of sensitive information.

Secure SDLC practices directly prohibit embedding secrets or sensitive data in source code.

A.5.12 only defines and communicates a classification scheme so that protection needs can be understood; it does not itself stop source code from containing or exposing sensitive information, per the owner's rule that labeling/classification is a dependency rather than a preventer unless other controls act on it.

A.5.15 only requires defining and communicating an access control policy plus rules that reference other controls; it performs no enforcement that would stop exploitation of sensitive information left in accessible source code.