Will It Vibe?Hardcoded password in a database connection string
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 8 points from that category, once per scan, no matter how many places it turns up.
What it detects
A connection string (Server=/Data Source=.../User Id=.../Password=...) carries a literal, non-placeholder password in source or an appsettings file, so anyone with repo access has a live database credential.
Why it matters
A live database password sitting in a connection string in source or an appsettings file is visible to everyone with repository access, every clone, and every CI log that prints configuration. Because the credential rarely gets rotated once committed, this single exposure often outlives the person who added it, and connection strings are a top target once an attacker gets any read access to a repo.
How to fix it
Move the password out of source control: use environment-variable substitution in appsettings.json (e.g. Password=${DB_PASSWORD} resolved by your hosting platform), .NET user-secrets for local development, or a managed secret store such as Azure Key Vault or AWS Secrets Manager for deployed environments. Rotate the credential that was already committed, since it must be treated as compromised.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo