Is it safe to put a password in DEFINE USER in SurrealDB?
DEFINE USER with a plaintext PASSWORD
Critical: SurrealDB refuses the migration, loses data, or leaks a credential.
What happens
Observed on SurrealDB 3.0.2: DEFINE USER ... PASSWORD $pw is a parse error, the password must be a literal, and INFO FOR DB shows only the PASSHASH SurrealDB derived from it.
Why it is dangerous on a populated table
Table size does not change this one: a password committed to the repository is live from the first deploy, and git history keeps it after the fix.
Fires on
DEFINE USER deploy ON DATABASE PASSWORD 'hunter2' ROLES EDITOR;The safe pattern
Use PASSHASH with an argon2 hash computed outside the repository, or create system users from provisioning with the password from your secret store.
DEFINE USER deploy ON DATABASE PASSHASH '$argon2id$v=19$m=19456,t=2,p=1$c2FsdA$aGFzaA' ROLES EDITOR;Fixtures
The rule ships with these files and the test suite runs them on every change: the first set must fire, the second must stay silent.
Fires (2)
DEFINE USER OVERWRITE reporting ON NAMESPACE PASSWORD 'r3port!ng' ROLES VIEWER DURATION FOR SESSION 1h;DEFINE USER deploy ON DATABASE PASSWORD 'hunter2' ROLES EDITOR;Stays silent (2)
DEFINE USER deploy ON DATABASE PASSHASH '$argon2id$v=19$m=19456,t=2,p=1$c2FsdA$aGFzaA' ROLES EDITOR;REMOVE USER IF EXISTS deploy ON DATABASE;How to check locally
SurrealDB support is in beta: this rule runs locally in the free CLI over .surql migrations, static only, and not in the hosted service yet. No install, nothing leaves your machine:
npx bolvrk check migration.surql --engine=surrealdb