Secure PostgreSQL Configuration Objects

Name: secure-postgresql-config-objects codemod
Availability: InStock

A security-focused codemod that automatically transforms PostgreSQL client configurations to use environment variables instead of hardcoded credentials, preventing credential leakage in source code.

Security Impact

CWE-798: Use of Hard-coded Credentials
CWE-256: Unprotected Storage of Credentials
OWASP Top 10 A07:2021 - Identification and Authentication Failures

Hardcoded database credentials in source code pose severe security risks:

Credentials are exposed in version control systems
Difficulty in credential rotation without code changes
Risk of credentials being leaked through code sharing
Compliance violations with security standards

What This Codemod Does

This codemod automatically identifies and transforms hardcoded database credentials in PostgreSQL client configurations (pg.Client and pg.Pool) to use environment variables with appropriate fallbacks.

Before

javascript

After

javascript

Transformation Rules

Field	Environment Variable	Has Fallback	Notes
`host`	`DB_HOST`	✅	Maintains original value as fallback
`port`	`DB_PORT`	✅	Uses `parseInt()` wrapper
`user`	`DB_USER`	✅	Maintains original value as fallback
`password`	`DB_PASSWORD`	❌	No fallback for security
`database`	`DB_NAME`	✅	Maintains original value as fallback

Installation

bash

Usage

Interactive Mode

bash

Target Specific Directory

bash

Dry Run (Preview Changes)

bash

Supported Patterns

Direct Constructor Calls

javascript

Configuration Variables

javascript

What Gets Skipped

This codemod intelligently skips transformations in the following cases:

Test Files: Files with .test.ts, .spec.js, etc.
Already Secured: Configurations already using process.env
No Hardcoded Values: Configurations without sensitive hardcoded data
Dynamic Values: Configurations using function calls or variables

After Running the Codemod

1. Set Environment Variables

Create a .env file or set environment variables:

bash

2. Load Environment Variables

For Node.js applications, use a package like dotenv:

bash

javascript

3. Verify Security

Ensure your .env file is in .gitignore:

gitignore

Environment Variable Reference

Variable	Description	Required	Example
`DB_HOST`	Database server hostname	No	`localhost` or `db.example.com`
`DB_PORT`	Database server port	No	`5432`
`DB_USER`	Database username	No	`postgres` or `myuser`
`DB_PASSWORD`	Database password	Yes	`your-secure-password`
`DB_NAME`	Database name	No	`myapp` or `production_db`

⚠️ Security Note: DB_PASSWORD has no fallback value. Your application will fail if this environment variable is not set, which is intentional for security.

Security Benefits

✅ Credentials removed from source code
✅ Environment-specific configuration
✅ Easier credential rotation
✅ Compliance with security best practices
✅ Version control safety
✅ Reduced risk of credential leakage

Related Security Resources

Development

bash

License

MIT

Registry

Ready to contribute?

codemod/secure-postgresql-config-objects

Run locally