Why I'm getting Hard coded password found here?

[Slobodan_Liric]

  @Value("${p12Name}")
  private String p12Name;

  @Value("${p12Alias}")
  private String p12Alias;

  @Value("${p12Password}")
  private String p12Token;
.............
    KeyStore keystore = KeyStore.getInstance("PKCS12");
    keystore.load(
        this.getClass().getClassLoader().getResourceAsStream(p12Name), p12Token.toCharArray());
    PrivateKey key = (PrivateKey) keystore.getKey(p12Alias, p12Token.toCharArray());

I’m getting SQ error in the line ‘keystore.load(’.
SQ version is 9.9 (build 65466)

[Colin]

Hey there.

I’ve moved your post to the section on reporting false-positives.

How to Report a False-positive / False-negative

Hey SonarSource Community! False-positives happen, as do false-negatives, and we’re eager to fix them. We are thrilled when our users report problems, so we can make our products better. What is a false-positive (FP)? A false-positive is when an issue is raised unexpectedly on code that should not trigger an issue, or where the suggested action doesn’t make any sense for the code. What is a false-negative (FN)? A false-negative is when an issue should be raised on a piece of code, but isn’t…

Can you specify which rule is raising an issue (the rule ID), or share a screenshot?

[Slobodan_Liric]

It’s (not java:S6437 ), findsecbugs:HARD_CODE_PASSWORD

[Slobodan_Liric]

this is a screenshot of this issue:

[Colin]

Ah, that’s a different story then. The issue is being raised by GitHub - findbugsproject/findbugs: The new home of the FindBugs project (via https://github.com/spotbugs/sonar-findbugs), and you’ll have to raise an issue with the maintainer.