Database Credentials Hardcoded in Application Source

What Is This Vulnerability?

Database connection strings or credentials (username and password) are written directly into the application source code. This means anyone with access to the codebase can connect to the database, read sensitive data, modify records, or drop tables entirely.

Why It Happens

During local development, developers hardcode database credentials for quick iteration. These values are often left in place when the code moves to staging or production. ORMs and database libraries that accept connection strings make it especially easy to paste credentials inline.

Example Code

import { Pool } from "pg";

const pool = new Pool({
  host: "production-db.example.com",
  port: 5432,
  database: "myapp_production",
  user: "admin",
  password: "P@ssw0rd!2024Pr0d",
});

export default pool;

import { Pool } from "pg";

const pool = new Pool({
  connectionString: process.env.DATABASE_URL,
  ssl: process.env.NODE_ENV === "production" ? { rejectUnauthorized: true } : false,
});

export default pool;

How Hackers Exploit It

Attackers who gain access to the source code (through a leaked repo, compromised developer machine, or insider threat) can directly connect to the database using the exposed credentials. From there, they can exfiltrate user data, inject malicious records, escalate privileges, or destroy the entire database.

How to Fix It

Store database credentials in environment variables or a secrets manager. Use connection strings loaded from process.env. Ensure database passwords are rotated regularly and that each environment (development, staging, production) uses separate credentials. Restrict database network access with firewalls and allow-lists.

Frequently Asked Questions