ST-SEC-009 Securestring miusage

[sowmiya.anbalagan (Sowmiya)]

While using analyze project, I am getting securestring misuage error. Kindly advice a solution to resolve this error.

[jack.chan]

@sowmiya.anbalagan

securestring misuage

do you have passwords stored as plain text in any activity?
activities should have the option of letting you input passwords as secure string instead of string (if you use the latest versions)

Studio - ST-SEC-009 - SecureString Misusage

'Send SMTP Mail Message' Password - SecureString

Thanks @lukasziebold. Have read the post you kindly provided. For me it looks like the rule in the anlayzer is a bit overzealous (because the securestring variable is the only variable (there is no text equivalent in variables and it is only converted inside the SMTP (using the method proposed in the original thread) and it is scoped very tightly and the SMTP activity is private, BUT for me that is OK. it highlights the use of the securestring so from a governance perspective this can always be …

Best Practice SecureString in plain string credential property fields

But we still get red flag from workflow analyzer if we use as posted by requestor,the way of Converting secure string to string is valid but still flagged. Any solution on this point of view

[supermanPunch (Arpan)]

Hi @sowmiya.anbalagan ,

If the Environment is not restricted, we could also try changing the Default Action for the Rule in Project Settings like below :