Will It Vibe?Hardcoded database credentials in DriverManager.getConnection
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 15 points from that category, once per scan, no matter how many places it turns up.
What it detects
DriverManager.getConnection is called with literal username and password strings instead of values read from configuration or a secret store, so the credential lives in source control.
Why it matters
A database username and password written as literals in DriverManager.getConnection travel with the source everywhere it goes: every clone, every CI log, every commit in history. Rotating that credential later means finding every place it was copied, and by then it may already be in a fork or a backup.
How to fix it
Read the URL, username, and password from configuration (application.properties/application.yml through @Value or @ConfigurationProperties, or environment variables) and inject them, or resolve them from a secret manager (Vault, AWS Secrets Manager, or your cloud provider's equivalent). Keep only a placeholder in any committed config file.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo