# False Postitive: S6418 triggers on web.config UserSecrets builder

**URL:** <https://community.sonarsource.com/t/false-postitive-s6418-triggers-on-web-config-usersecrets-builder/179611>\
**Category:** Report False-positive / False-negative...\
**Tags:** csharp\
**Created:** [March 13, 2026, 4:16pm UTC](https://community.sonarsource.com/t/false-postitive-s6418-triggers-on-web-config-usersecrets-builder/179611 "2026-03-13T16:16:28Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Keith.Banner](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/keith.banner/32/65983_2.png) [@Keith.Banner](https://community.sonarsource.com/u/Keith.Banner)\
**Post date:** [March 13, 2026, 4:16pm UTC](https://community.sonarsource.com/t/false-postitive-s6418-triggers-on-web-config-usersecrets-builder/179611/1 "2026-03-13T16:16:28Z")

</div>

This happened using SonarQube Server Enterprise Edition v2025.6.1 (117629)

The scan was completed from an Azure DevOps pipeline using the task SonarQubeAnalyze version 7.4.2

What language is this for?  
C#

Which rule?  
S6418 (Hard-coded secrets are security-sensitive)

Why do you believe it’s a false-positive/false-negative?

This is a very simple example of the UserSecretsConfig builder for .net framework. It is the accepted best practice for quickly and easily providing secrets to a local instance of a .net framework web app. See [this documentation](https://learn.microsoft.com/en-us/aspnet/config-builder#usersecretsconfigbuilder) for more details on this setup.

```auto
<configuration>
  <configBuilders>
    <builders>
      <add name="Secrets" userSecretsId="2073424b-d6d8-4c0b-9ac1-94a6f55894b9" type="Microsoft.Configuration.ConfigurationBuilders.UserSecretsConfigBuilder, Microsoft.Configuration.ConfigurationBuilders.UserSecrets, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
    </builders>
  </configBuilders>
  <appSettings configBuilders="Secrets">
    <!-- Nothing relevant within this section. Just typical settings. No secrets. -->
  </appSettings>
</configuration>

```

SonarQube is triggering specifically on the string `userSecretsId`

It is not flagging an actual secret. The message is:

> “userSecretsId” detected here, make sure this is not a hard-coded secret.

There should be some kind of detection that userSecretsId is a common string in web.config files and at least in this specific context this line would never contain an actual secret.

How can we reproduce the problem? Give us a self-contained snippet of code (formatted text, no screenshots)

You should be able to create a new .net framework web project, install the `Microsoft.Configuration.ConfigurationBuilders.UserSecrets` NuGet package and add the config portion above if the NuGet package install doesn’t create it for you.

---

<div class="post-metadata">

**Author:** ![ganncamp](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ganncamp/32/1261_2.png) [@ganncamp](https://community.sonarsource.com/u/ganncamp)\
**Post date:** [March 13, 2026, 6:21pm UTC](https://community.sonarsource.com/t/false-postitive-s6418-triggers-on-web-config-usersecrets-builder/179611/2 "2026-03-13T18:21:19Z")

</div>

Hi,

Can you share the rule key that this was triggered from? I know you’ve said the project is C#, but this might be being picked up by a different language’s rule (e.g. XML).

&nbsp;  
Thx,  
Ann

---

<div class="post-metadata">

**Author:** ![Keith.Banner](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/keith.banner/32/65983_2.png) [@Keith.Banner](https://community.sonarsource.com/u/Keith.Banner)\
**Post date:** [August 25, 2026, 2:47pm UTC](https://community.sonarsource.com/t/false-postitive-s6418-triggers-on-web-config-usersecrets-builder/179611/3 "2026-08-25T14:47:57Z")

</div>

> [@Keith.Banner](#):
>
> `userSecretsId`

@ganncamp Sorry I never saw this notification. This was triggered from the C# csharpsquid:S6418.

---

<div class="post-metadata">

**Author:** ![ganncamp](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ganncamp/32/1261_2.png) [@ganncamp](https://community.sonarsource.com/u/ganncamp)\
**Post date:** [August 25, 2026, 3:42pm UTC](https://community.sonarsource.com/t/false-postitive-s6418-triggers-on-web-config-usersecrets-builder/179611/5 "2026-08-25T15:42:22Z")

</div>

Hi,

Thanks for that! I’ve flagged this for the team.

&nbsp;  
Thx,  
Ann