Hardcoded Database Connection String
Overview
Database connection strings containing credentials embedded directly in source code are exposed whenever the code is shared, committed to version control, or viewed by anyone with code access. This is one of the most common causes of database credential leaks.
Remediation
- Use environment variables for all credential components
- Use a secrets manager (AWS Secrets Manager, Vault, Azure Key Vault)
- Never commit
.envfiles with real credentials
Safe:
conn_str = os.environ["DATABASE_URL"]