Connection string in code (ARCH1105)

Key dotnet.resource.connection-string-in-code · Severity error · Category resource

Embedding a connection string in code exposes credentials in version control. Read connection strings from configuration.

Incorrect

var connection = new SqlConnection(
    "Server=db;Database=app;User Id=sa;Password=P@ssw0rd;");

Correct

public OrderRepository(IConfiguration config) =>
    _connString = config.GetConnectionString("Default");

var connection = new SqlConnection(_connString);

Fix

Read the connection string through IConfiguration (appsettings, environment variables, or a secret store) and remove credentials from code entirely.