Will It Vibe?JDBC URL with embedded password
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 15 points from that category, once per scan, no matter how many places it turns up.
What it detects
A JDBC URL carries the database password as a query parameter. It exposes the database to anyone who can read the file.
Why it matters
A JDBC URL that carries the password as a query parameter exposes the database credential in source control and often in application logs, since the full URL is frequently logged. Anyone who reads it can connect to the database. The value persists in git history.
How to fix it
Pass the password separately from the URL through your connection properties, read from an environment variable or a secrets manager. Keep the real value untracked. Rotate the database password after removing it.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo