CWE-1099, Inconsistent Naming Conventions for Identifiers, describes a product whose code, documentation or other artifacts do not use the same naming conventions consistently for variables, callables, groups of related callables, I/O capabilities, data types, file names and similar elements.
MITRE marks it as a quality issue with no direct security implications and prohibits it for mapping real vulnerabilities.
How it happens
Naming drifts when many people contribute over years. One module uses getUserName, another fetch_username, a third usr_nm. Booleans are isValid in one place and valid_flag in another. File names mix cases and separators.
# Smell: three names for the same idea
def check_auth(u): ...
def verifyUser(user): ...
def is_allowed_login(usr): ...
A reader cannot tell whether these do the same thing, whether one is stricter, or which one a new endpoint should call. That ambiguity is where the wrong function gets picked.
What an attacker gains
Nothing directly. MITRE lists reduced maintainability and increased analytical complexity, with the indirect effect of making vulnerabilities harder and slower to find and fix. Security checks with unclear names are especially easy to call wrongly or skip.
How to find it
MITRE lists automated static analysis as a detection method. Linters have naming rules for most languages. A quick manual check is to search for the same concept under several spellings.
How to fix it
- Write a short naming guide: case style, prefixes, how booleans and errors are named.
- Enforce it with a linter and a formatter in CI.
- Rename in small, tested steps, using editor refactoring tools.
- Give security checks distinct, honest names, such as
require_adminrather thancheck.
Try it yourself
See how a static scan reports code quality and security findings together.
Click through it at your own pace, or open it full screen.
Quick check
How can naming affect security?
Unclear or inconsistent names make it easier to call the wrong check, or to skip one, during development and review.
