Is it safe to seed a SurrealDB user with crypto::argon2::generate?

Hard-coded password hashed in the migration

Critical: SurrealDB refuses the migration, loses data, or leaks a credential.

What happens

crypto::argon2::generate('...'), or the bcrypt, scrypt and pbkdf2 equivalents, with a string literal stores a hash, but the password it hashes sits in the migration file in plaintext, committed and kept in git history. Seeding an admin record this way publishes its password.

Why it is dangerous on a populated table

Table size does not change this one: the password is in the file from the first commit, and git history keeps it after the fix.

Fires on

CREATE user:admin SET email = 'admin@example.com', pass = crypto::argon2::generate('changeme123');

The safe pattern

CREATE user:admin SET email = 'admin@example.com', pass = crypto::argon2::generate($admin_password);

Fixtures

The rule ships with these files and the test suite runs them on every change: the first set must fire, the second must stay silent.

CREATE user:admin SET email = 'admin@example.com', pass = crypto::argon2::generate('changeme123');

UPDATE user:admin SET pass = crypto::bcrypt::generate('letmein');

CREATE user:admin SET email = 'admin@example.com', pass = crypto::argon2::generate($admin_password);

DEFINE ACCESS account ON DATABASE TYPE RECORD SIGNUP (CREATE user SET email = $email, pass = crypto::argon2::generate($pass)) DURATION FOR SESSION 24h;

How to check locally

npx bolvrk check migration.surql --engine=surrealdb