Secret written into a compose file (ARCH10014)

Key config.compose.plaintext-secret · Severity warning · Category security · CWE CWE-798

A password or token written into a compose file is in the repository and its history: everyone who can read the repository has it. Map and list forms of environment are both read; the name must end in a secret word and the value must be written out.

Incorrect

services:
  db:
    image: postgres:16.4
    environment:
      POSTGRES_PASSWORD: change-me-123

Correct

services:
  db:
    image: postgres:16.4
    environment:
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}

Fix

Read the value from an .env file kept out of the repository (${POSTGRES_PASSWORD}), or from a compose secret (/run/secrets/...).

Not flagged

• ${VAR} references, env_file, /run/secrets/ paths and empty values.
• Names that only mention a secret: POSTGRES_PASSWORD_FILE, TOKEN_URL.