# Hardcoded Database Connection String

> Detects database connection strings with embedded credentials hardcoded in source code.

- Skill: `zakirkun/hardcoded-database-connection-string` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/hardcoded-database-connection-string`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/hardcoded-database-connection-string/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/hardcoded-database-connection-string

---


# Hardcoded Database Connection String

## Overview
Database connection strings containing credentials embedded directly in source code are exposed whenever the code is shared, committed to version control, or viewed by anyone with code access. This is one of the most common causes of database credential leaks.

## Remediation
- Use environment variables for all credential components
- Use a secrets manager (AWS Secrets Manager, Vault, Azure Key Vault)
- Never commit `.env` files with real credentials

**Safe:**
```python
conn_str = os.environ["DATABASE_URL"]
```