Passwords and keys written into SQL files

This rule flags lines that assign a single-quoted literal of six or more characters to a credential-shaped name. The names include password, identified by, credentials, secret, access_key and private_key. Prefixed forms such as db_password and AWS_SECRET_KEY count too. Lines commented out with -- are ignored. So is a line using a template or parameter, such as {{ }}, :name or @name.

A secret in a SQL file is in every clone and in the history, including for people who have left. Deleting the line does not remove it from history.

Take credentials out of the SQL and rotate them. Move the value to the warehouse's secret store or a bind parameter, then rotate it. Rotation is the fix; deleting the line leaves the old value in history.

Before:

-- setup/loader.sql
alter user loader set password = 'placeholder-value';

After:

-- setup/loader.sql: the value is supplied at run time
alter user loader set password = :loader_password;

A placeholder for a throwaway local database, in a setup script nobody points at a real warehouse. Make the placeholder obviously fake. Tell us, and the finding comes out of your report.

The .sql files, read from your repository with read-only access or uploaded. We record line numbers only, never the line or the value. Files over 500,000 characters are skipped. With no SQL file read, we decline.