T09 · Insecure Skill Coding Practices
- Location
scripts/setup-org-db.sh:19- Finding
Database Connection Credentials Exposed in Standard Output
- Content
View full analysis
Vulnerability Details
File Location:
scripts/setup-org-db.sh, lines 19 and 88
Vulnerability Type: Plaintext sensitive-data disclosure
Risk Level: HighVulnerable Code
bash CONN_STRING=$(neonctl connection-string --project-id "$PROJECT_ID" --pooled)bash echo "Project ID: $PROJECT_ID" echo "Connection: $CONN_STRING" echo "" echo "Save these to your org config!"Technical Analysis
The script retrieves a Neon PostgreSQL connection string and stores it in
CONN_STRING. Such connection strings normally include a database username, password, hostname, and database name. Line 88 then prints the complete value to standard output without redaction.Standard output is frequently retained in CI/CD job logs, terminal capture files, AI Agent transcripts, centralized log aggregation systems, and automation records. Consequently, a user or service with permission to read those records may obtain reusable database credentials even if they are not authorized to access Neon secrets directly.
Attack Path
- An authorized user or automation service executes
scripts/setup-org-db.sh. neonctl connection-stringreturns a credential-bearing PostgreSQL URI.- The script prints the complete URI to standard output.
- A CI system, Agent platform, terminal recorder, or logging service retains the output.
- An attacker or lower-privileged user obtains read access to the retained output.
- The exposed URI is supplied to
psqlor another PostgreSQL client. - The attacker gains the database privileges assigned to the role embedded in the URI.
Impact Assessment
Exploitation can grant remote access to the newly created Neon database with all privileges assigned to the disclosed database role. Depending on that role, an attacker may be able to read, insert, modify, or delete organizational leads, tasks, metrics, and activity-log data. The attacker may also alter the schema or d ...[truncated 293 chars]
- An authorized user or automation service executes
- Remediation
View remediation
Remediation Suggestions
- Remove the statement that prints
CONN_STRING. - Display only non-sensitive identifiers, such as the Neon project ID and a redacted database hostname.
- Transfer the connection URI directly into an approved secret manager rather than returning it in terminal output.
- If a local configuration file is necessary, create it with restrictive permissions such as mode
0600, avoid committing it to version control, and document its sensitive nature. - Configure CI/CD and Agent platforms to mask known secret values and prevent command output containing credentials from being retained.
- Rotate the associated Neon database password if the script has already been run in any logged environment.
- Prefer a dedicated least-privileged application role rather than distributing a project owner or administrative connection string.
- Remove the statement that prints