No hardcoded database credentials in source code

A hardcoded database connection string or password in source code is exposed to every developer with repo access, in every git clone, in CI logs, and in any code review tool. Once committed to git history, it is permanently visible even after removal — any attacker who ever had read access to the repo has the credential. CWE-798 (use of hard-coded credentials) and OWASP A07 both recognize this as a critical failure because the attacker does not need to compromise the server — they only need to access the repository. Credential rotation after exposure is the only remediation, and it requires a production deployment under time pressure.

Load all database credentials from environment variables. Ensure .env is in .gitignore. Provide .env.example with placeholder values only — never real connection strings.

// WRONG — never hardcode credentials
// const pool = new Pool({ connectionString: 'postgres://admin:prod_pass@db.example.com/app' })

// CORRECT — load from environment
if (!process.env.DATABASE_URL) throw new Error('DATABASE_URL is required')
export const pool = new Pool({ connectionString: process.env.DATABASE_URL })

# .gitignore — confirm these are excluded
.env
.env.local
.env.production

# .env.example — placeholders only (commit this)
DATABASE_URL=postgresql://USER:PASSWORD@HOST:PORT/DATABASE

If credentials were accidentally committed: rotate them immediately, then audit git history with git log --all -S "the_exposed_value" to assess the exposure window.