No default or test accounts in non-test code

Hardcoded default credentials (CWE-798) in seed scripts or initialization code are one of the most targeted attack vectors — automated scanners look for accounts with passwords like 'admin123', 'password', or 'test' within minutes of a deployment. OWASP A07 includes default credentials as a named authentication failure. PCI-DSS v4.0 Req-2.2.2 requires that vendor default accounts are either removed/disabled or have their default passwords changed per Req-8.3.6. A seed script that creates an admin account without an environment guard may silently run in production during a migration or initial deploy, creating a fully privileged account with a known, public password.

Gate any seed script that creates user accounts behind a strict environment check and use environment variables for any credentials that must exist in non-production environments:

// prisma/seed.ts
if (process.env.NODE_ENV === 'production') {
  console.log('Skipping seed in production')
  process.exit(0)
}

// Never use hardcoded passwords — even in dev:
const adminPassword = process.env.DEV_ADMIN_PASSWORD
if (!adminPassword) throw new Error('DEV_ADMIN_PASSWORD not set')
await db.user.create({ data: { email: 'admin@dev.local', passwordHash: await bcrypt.hash(adminPassword, 12) } })

Add a CI grep step in .github/workflows/ to fail the build if hardcoded passwords like admin123, password, or test appear in non-test source files. Remove any existing default accounts from migration SQL before the next deploy.