High severityPythonHardcoded SecretsHIGH confidence
DB Connection String Credentials
A database/service connection string embeds credentials in a URL literal (CWE-798).
Standards mapping
- OWASP ASVS
- V6.4.1 (L2)V2.10.4 (L2)
Vulnerable vs. safe
Flagged by this check
DATABASE_URL = "postgresql://admin:[email protected]:5432/app"Passes - the safe pattern
DATABASE_URL = os.environ["DATABASE_URL"]Why it matters & how to fix it
A database/service connection string embeds credentials in a URL literal (CWE-798). The password travels through source control and logs. Move the URL (or at least the password) into an environment variable or secrets manager and rotate the exposed credential.
References
Rule ID integsec-python-db-connection-string-credentials - engine: Opengrep - license: MIT - Copyright (c) IntegSec Inc.
TurboPentest runs this check automatically
Connect a GitHub repo and this check runs on every white-box pentest - AI-validated and reported with proof, from $99 per target.
Start a pentestRelated checks
- JavaScript / TypeScript - Hardcoded SecretsBasic Auth Credentials In URL
- JavaScript / TypeScript - Hardcoded SecretsDB Connection String With Credentials
- JavaScript / TypeScript - Hardcoded SecretsHardcoded Credential String
- JavaScript / TypeScript - Hardcoded SecretsHardcoded Crypto Key Or IV
- Python - Hardcoded SecretsBasic Auth Credentials In URL
- Python - Hardcoded SecretsDjango Databases Password Literal