'Send SMTP Mail Message' Password - SecureString

What’s odd is that they seem to be concerned with the improper use of the SecureString and yet have activities that accept passwords as plain text, such as the Send Exchange Message. If you are getting your credentials from an asset, you are forced to cast it to string to use these activities. This will trigger the analyzer error.

Solo developers can just disable this rule. But what if you are enforcing a governance policy at the enterprise level?

1 Like