critical
postgres-connection-string· DatabasePostgres connection string
Direct database access with the embedded password — reads and writes every row, bypassing every application-level check.
How it is detected
Matches a `postgres://` or `postgresql://` URL carrying a password. Strings using well-known tutorial credentials, or pointing at localhost, are reported lower — the password is still exposed, but the database probably is not.
If you find one
- 1Change the password on the database user immediately.
- 2Check for tables you do not recognise and rows you did not write.
- 3Put the database behind an API. A browser should never hold a connection string.
Where it turns up
Most often in admin dashboards querying the database from the browser.