CWE-798: Use of Hard-coded Credentials
A weakness where software contains a hardcoded credential (password, key, or token) used for authentication or encryption.
Why It Matters
CWE-798 is one of the most consistently high-severity weaknesses across every application type, mobile or otherwise, because it collapses the distance between "has the binary" and "has valid credentials" to zero.
Application to Application Security
This is the CWE-level identifier underlying OWASP Mobile M1 (Improper Credential Usage) — the same weakness, described at the taxonomy level MITRE maintains independent of any one top-N framework's category numbering.
Relation to Software Development
Introduced the same way across languages and platforms: a credential written as a literal value rather than injected via configuration, environment variable, or a runtime secrets fetch.
How Strata Surfaces This
Entropy and pattern-based scanning of decompiled source and binary strings, plus git history scanning for credentials that were committed and later removed.
Developer guidance
Treat any literal string that grants access or decrypts data as a credential, not just fields explicitly named password or secret — key material and tokens carry the same risk.
Management guidance
CWE-level tracking lets you compare credential-handling weaknesses across projects using different frameworks' own numbering — useful when consolidating findings across a portfolio.