Inline connection string password (ARCH328)

Key dotnet.security.connection-string-password · Severity warning · Category security · CWE CWE-798

Embedding a plaintext password in a connection string exposes credentials in the source repository. Anyone with repo access can connect to the database.

Incorrect

var connection = new SqlConnection(
    "Server=db;Database=app;User Id=sa;Password=P@ssw0rd!;");

Correct

var connection = new SqlConnection(
    configuration.GetConnectionString("Default"));
// Password supplied via environment variable / secret store

Fix

Remove passwords from source; load connection strings from environment variables, User Secrets, or a secret store such as Key Vault.