Secure Sequelize Connection Strings
Security Critical: Automatically removes hardcoded database credentials from Sequelize connection strings and replaces them with secure environment variables.
Problem
Hardcoded database credentials in Sequelize connection strings create serious security vulnerabilities:
- Credentials are exposed in source code and version control
- Passwords are visible to anyone with repository access
- Risk of credential leakage in logs, error messages, and backups
- Violation of security best practices and compliance requirements
Solution
This codemod automatically:
- Detects hardcoded credentials in Sequelize connection strings and configuration objects
- Replaces them with secure environment variable references
- Maintains functionality while improving security posture
- Supports multiple database types (PostgreSQL, MySQL, MariaDB, SQLite)
Installation
Transformations
Connection String URIs
Before:
After:
Configuration Objects
Before:
After:
Connection String Properties
Before:
After:
Security Features
- Smart Detection: Only transforms files that actually use Sequelize
- Test Exclusion: Automatically skips test files and mock credentials
- Credential Recognition: Detects various database URI formats
- Context Aware: Preserves non-sensitive configuration while securing credentials
Environment Variables
After running this codemod, ensure you set the following environment variables:
Security References
- CWE-798: Use of Hard-coded Credentials
- OWASP Top 10 A07:2021 Identification and Authentication Failures
Development
License
MIT