Skip to main content

SEC-003: Sensitive Configuration Must Use Environment Variables

AttributeValue
CategorySecurity Standards
Default Severitywarning
Applicable FilesConfig and service files

Why It Exists (Rationale)​

Connecting strings to databases, caches, message brokers, and SMTP relays frequently contain sensitive embedded credentials (e.g., postgres://user:password@host:5432/db). Hardcoding these URIs:

  • Precludes configuration polymorphism between development, staging, and production environments.
  • Leaks database credentials into source control repositories.
  • Violates 12-Factor App methodology (Principle III: Config in the environment).

All infrastructure endpoints and connection URIs should be provided via environment variables.

Bad Example​

// ❌ Hardcoded database connection strings
export const dbConfig = {
  connectionString: "postgres://postgres:adminSecret123@prod-db.internal:5432/main",
  redisUrl: "redis://:redisSecretPassword@cache.internal:6379",
};

Good Example​

// ✅ Loaded from environment variables with fallback defaults for local development
export const dbConfig = {
  connectionString: process.env.DATABASE_URL ?? "postgres://localhost:5432/dev",
  redisUrl: process.env.REDIS_URL ?? "redis://localhost:6379",
};

How It's Detected​

ArchStandards scans configuration, service, and infrastructure initialization files for connection string patterns (postgres://, mysql://, mongodb://, redis://) assigned to variables without referencing process.env.

Exception Configuration​

exceptions:
  - rule: "SEC-003"
    path: "src/config/local-docker.ts"
    reason: "Public default credentials for local docker-compose environment."