---
title: "Passwords and keys written into SQL files | Metacenta"
description: "How we find passwords and access keys written into SQL files without reading the values, and why rotating the credential matters more than deleting it."
url: "https://metacenta.com/rules/sql-credential-literal"
updated: "2026-10-14"
tokens: 603
---

Repository hygiene · rule sql-credential-literal

# Passwords and keys written into SQL files

A Metacenta review checks this under the rule **No credential is written into SQL**. Everything below applies whether or not you ever commission one.

## What this rule checks

This rule flags lines that assign a single-quoted literal of six or more characters to a credential-shaped name. The names include `password`, `identified by`, `credentials`, `secret`, `access_key` and `private_key`. Prefixed forms such as `db_password` and `AWS_SECRET_KEY` count too. Lines commented out with `--` are ignored. So is a line using a template or parameter, such as `{{ }}`, `:name` or `@name`.

## Why it matters

A secret in a SQL file is in every clone and in the history, including for people who have left. Deleting the line does not remove it from history.

## How to fix it

**Take credentials out of the SQL and rotate them.** Move the value to the warehouse's secret store or a bind parameter, then rotate it. Rotation is the fix; deleting the line leaves the old value in history.

Before:

```sql
-- setup/loader.sql
alter user loader set password = 'placeholder-value';
```

After:

```sql
-- setup/loader.sql: the value is supplied at run time
alter user loader set password = :loader_password;
```

## When it is fine to leave

A placeholder for a throwaway local database, in a setup script nobody points at a real warehouse. Make the placeholder obviously fake. Tell us, and the finding comes out of your report.

## What we need to check it

The `.sql` files, read from your repository with read-only access or uploaded. We record line numbers only, never the line or the value. Files over 500,000 characters are skipped. With no SQL file read, we decline.

[Ask about a review](https://metacenta.com/enquire?src=rule-sql-credential-literal&via=md)

## Related pages

- [Credential files committed to a data repository](https://metacenta.com/rules/repo-committed-credential-file)
- [Data repository with no CI pipeline](https://metacenta.com/rules/repo-no-ci)
- [Archived repositories under review](https://metacenta.com/rules/repo-archived)
- [Data repository with no tests](https://metacenta.com/rules/repo-no-tests)
- [A sample review, as a client reads it](https://metacenta.com/sample)
- [All published rules](https://metacenta.com/rules)
- [How a review is assessed](https://metacenta.com/standard)