SEC-017
Database credentials exposed to the browser
CriticalDefault severity · Security · Secrets, HTTPS and security headers
Last reviewed
What it checks
Connection strings with a password (Postgres, MySQL, MongoDB, Redis) in the page and its scripts.
Why it matters
Anyone can connect straight to your database and read, change or delete every record.
Recommended fix
Change the database password now and only connect to the database from server code.
How to verify
Change the database password, redeploy, and search the built JavaScript for "://" connection strings to confirm none remain.
Example fix prompt
Generic prompt (your report adds the evidence)
Please fix this production issue in my app.
Issue SEC-017: Database credentials exposed to the browser
Site: https://your-app.example
First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: A database connection string with a password is included in client-side code. Remove it from every client bundle, read it only from a server-only environment variable, and make sure all database queries run in server code (API routes, server actions or edge functions).
Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Change the database password, redeploy, and search the built JavaScript for "://" connection strings to confirm none remain.