Qualified static finding recorded.
CodeVetter · local evidence export
Hardcoded database credentials in Go
codevetter-public-benchmark/go-hardcoded-credentials
detected · high confidence
Verification
No exact-current runtime evidence is included.
No audience validation occurred.
Finding
hardcoded secret
Production database username, password, and host are committed in plaintext as package-level constants, exposing credentials to anyone with repository access.
source.go:7