Rules / GL036

GL036 Connection string with embedded credentials in variables: block

Severity: warn
OWASP: CICD-SEC-6 – Insufficient Credential Hygiene

What glsec checks

glsec flags variable values in any variables: block — top-level or job-level — that contain a URL with embedded userinfo credentials in the form scheme://user:password@host. The check is on the value, not the key name, covering database URLs (DATABASE_URL), search engine URLs (ELASTIC_URL), cache URLs (REDIS_URL), and any other service URL that embeds credentials.

A value is only flagged when the password segment does not begin with $ — variable references such as ${DB_PASSWORD} are considered safe.

Complements GL006, which detects hardcoded secrets via key-name heuristics.

Trigger example

variables:
  DATABASE_URL: "postgres://myapp:s3cr3t@postgres:5432/mydb"
  ELASTIC_URL: "http://elastic:changeme@elasticsearch:9200"

Safe alternative

variables:
  DATABASE_URL: "postgres://myapp:${DB_PASSWORD}@postgres:5432/mydb"
  # DB_PASSWORD stored as a protected, masked CI variable

References

• GL006: hardcoded secret in variables: block (key-name heuristic)
• GL035: git URL with embedded credentials in script
• GL038: hardcoded credential literal passed to CLI tool in script

Documentation for glsec 1.23.0. Source of this page · Rule implementation