MongoDB connection string

How it is detected

Matches a `mongodb://` or `mongodb+srv://` URL carrying a password.

If you find one

1. 1Change the password on the database user immediately.
2. 2Check for tables you do not recognise and rows you did not write.
3. 3Put the database behind an API. A browser should never hold a connection string.

Where it turns up

Most often in client bundles built by AI coding tools.