Don t Embed Corporate Names

Don't Embed Corporate Names

I know you've done this; I certainly have. You've written a small code stub to exercise some functionality prior to adding it to the production code. And as you tested it, you needed to make sure it worked with real servers, so you hardcoded an internal server name and connected to it by using a hard-coded account name and potentially a hard-coded password. If you allow this kind of code, you should at least wrap a predefined #ifdef around the code:

#ifdef INTERNAL_USE_ONLY # ifndef _DEBUG # error "Cannot build internal and non-debug code" # endif // _DEBUG // experimental code here #endif // INTERNAL_USE_ONLY

NOTE
This code goes a little futher. The compiler will fail to compile when the code is being compiled for non-debug (release build) and internal use.

You should also consider scanning all source code for certain words that relate to your company, including the following:

• Common server names (DNS [Domain Name System] and NetBIOS names)

• Internally well-known e-mail names (such as the CEO)

• Domain accounts, such as EXAIR\account and [e-mail].