# ST-SEC-008 - SecureString Variable Usage

> **Rule ID**: `ST-SEC-008`

**Rule ID**: `ST-SEC-008`

**Scope**: Workflow

## Description

This rule checks the variable usage of **SecureString** type in the workflow.

## Recommendation

After a SecureString is retrieved, it is recommended to be logged into applications with the help of [Type Secure Text](https://docs.uipath.com/activities/docs/type-secure-text) activity which sends a SecureString to a UI element, and [Send Keys Secure](https://docs.uipath.com/activities/docs/terminal-send-keys-secure) activity for Terminals.

It is important for the credential to **not** be used for any purpose other than the intended one. Variables holding such secure strings should be defined at the narrowest scope possible.

Arguments should ideally not be used for passing credentials from one workflow to another. Read more about the [SecureString class](https://docs.microsoft.com/en-us/dotnet/api/system.security.securestring?view=netframework-4.8) in the official Microsoft documentation.

![docs image](https://dev-assets.cms.uipath.com/assets/images/studio/studio-docs-image-168105-595c6586.webp)

## Modifying the Rule

In the **Project Settings** window, select the **Workflow Analyzer** tab. Find the rule and select the rule, as in the image below:

![docs image](https://dev-assets.cms.uipath.com/assets/images/studio/studio-docs-image-168783-61206c15.webp)

By default, this rule checks for the **Variable depth usage** of 1. The maximum limit is 3. This means that the rule checks whether variables of SecureString type are defined in an activity found inside a layer of two container activities. For example, a SecureString type variable inside a Type Secure Text activity defined in a Do container, and all part of a Sequence.

To change the depth, simply type in another number smaller than or equal to 3 in this field.

## Reset to Default

By default, the rule checks for one **Variable depth usage**. To return to the default value after modifications were made, simply right-click the rule and select **Reset to default**.

![docs image](https://dev-assets.cms.uipath.com/assets/images/studio/studio-docs-image-172536-edadfb44.webp)

The **Default action** is also reset to its default value **Error**.