Feedback on hard-coded usernames and passwords in Chef script

[akondasif]

Greetings,

I am a security researcher, who is looking for security smells in Chef scripts.
I found instances where usernames and passwords are specified within a Chef script.
According to the Common Weakness Enumeration organization this is a security weakness
(CWE-798: Hard-coded credentials https://cwe.mitre.org/data/definitions/798.html).

I am trying to find out if you agree with the findings and the reasons the usernames and passwords were introduced. Any feedback is appreciated.

Source:

1. https://github.com/Graylog2/graylog2-cookbook/blob/master/spec/unit/recipes/server_spec.rb

[mariussturm]

@akondasif the code in question is an integration test. The username ans password is not used anywhere else so this should be no issue.