Connection string with an embedded password in a string literal
Critical — a working credential committed to the repository; rotate it, git history keeps it.
What it catches
A DSN like postgres://app:hunter2@db.internal/app or host=… password=… seeded into a settings row, a column DEFAULT, or a dblink() call is a live credential in a committed file. It is also the one that spreads furthest — a DSN in a settings table is read by every service that loads settings. Only fires when the string parses as a libpq-style URI or keyword string with a non-empty, non-placeholder password.
Fires on
INSERT INTO integrations (name, dsn) VALUES ('warehouse', 'postgres://etl:hunter2@warehouse.internal:5432/dw');Do this instead
Store the DSN without the password and let the service resolve it at runtime from its secret store, or seed a placeholder the deploy substitutes. Both forms stay silent: a URI with no password, or an env-style slot in its place.
INSERT INTO integrations (name, dsn) VALUES ('warehouse', 'postgres://etl@warehouse.internal:5432/dw');
-- the service reads PGPASSWORD / a passfile at runtime This rule runs locally in the free CLI — or with the full corpus through the hosted service: npx bolvrk check migration.sql