# The Java analyzer detect secrets hidden in your Java files **URL:** \ **Category:** Sonar Updates\ **Tags:** secrets, security, java\ **Created:** [June 3, 2022, 8:54am UTC](https://community.sonarsource.com/t/the-java-analyzer-detect-secrets-hidden-in-your-java-files/64295 "2022-06-03T08:54:53Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![Alexandre\_Gigleux](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/alexandre_gigleux/32/26_2.png) [@Alexandre\_Gigleux](https://community.sonarsource.com/u/Alexandre_Gigleux)\ **Post date:** [June 3, 2022, 8:54am UTC](https://community.sonarsource.com/t/the-java-analyzer-detect-secrets-hidden-in-your-java-files/64295/1 "2022-06-03T08:54:53Z")
Hello Java developers, We used to have a rule ([S2068](https://rules.sonarsource.com/java/RSPEC-2068)) detecting hard-coded credentials in your Java files. While being good, this rule was only focusing by default on “passwords” and it was recommended to configure it to detect more such as secrets. We realized that not a lot of users were doing the effort to customize the rule, and because we want you to get the best of our rules out of the box we decided to do the following changes: - [S2068](https://rules.sonarsource.com/java/RSPEC-2068) is now dedicated to finding hard-coded **passwords** - a new rule [S6418](https://rules.sonarsource.com/java/RSPEC-6418) was introduced to focus on detecting hard-coded **secrets** The new rule detects variables/fields having a name matching a list of words (secret, token, credential, auth, api[\_.-]?key) being assigned a pseudorandom hard-coded value. The pseudorandomness of the hard-coded secret is based on its entropy and the probability to be human-readable. The randomness sensibility can be adjusted if needed. These two rules are enabled by default and the results are visible on the Security Hotspots page. They are available now on [SonarCloud.io](https://sonarcloud.io/)and will be part of SonarQube 9.5. Alex