Detection reference · Credentials and secrets · Updated 2026-11-03

Passwords in URLs and connection strings

Database URLs, Redis URLs and webhook endpoints often carry a password between the user name and the @. Redaxa replaces only that part, so the AI still sees which database and host you are asking about.

At a glance

Reported as	Password in a URL
Category	Credentials and secrets
Severity	critical: direct account or system compromise, as with keys, passwords and tokens
Replaced with	`[REDACTED]`
Where it runs	The same engine runs in the Chrome extension (free checks, on your device), in the web check and the Windows app (on Redaxa's server; the text is not stored) and in public repository checks.
Engine rule	scanner.ts, line 186

What it looks like

A scheme, ://, a user name, a colon, then the password up to the @. Placeholders such as ${DB_PASSWORD} or the literal word password are skipped.

Example

You paste

DATABASE_URL=postgres://app:Rx82jfDocsSample@db.internal:5432/main

Redaxa returns

DATABASE_URL=postgres://app:[REDACTED]@db.internal:5432/main

Reported as	Password in a URL
Severity	critical: direct account or system compromise, as with keys, passwords and tokens
Replaced with	`[REDACTED]`
Probable service	Unknown service
Credential type	Password in a URL
Evidence	The value alone does not identify its owner or issuing service.
Recommended action	Identify owner, then rotate if genuine

All values on this page are synthetic or published specimens; none is a working credential or a real person's data.

In a repository check

The same example, committed to a public repository and run through the free repository check:

docker-compose.yml: Password in a URL, listed as a reference, not counted as an exposure (severity info). Test or example value, counted but not listed. Real-looking keys in test files are still reported.
Same value in tests/fixtures/docker-compose.yml: Test or example value, counted but not listed. Real-looking keys in test files are still reported.

Values are always shown masked in repository reports. No key is ever tested against its provider.

What it does not flag

postgres://app:${DB_PASSWORD}@db.internal/main: not flagged. An environment variable reference is not a literal password.
postgres://app:password@db.internal/main: not flagged as Password in a URL; flagged as Email address. The bare word password is a documentation placeholder, so the URL rule skips it; the email rule then reads password@db.internal as an address. A known overlap.

If it already leaked

Change the database or service password, update every place that uses the URL, and move the URL into a secret store or environment variable.

What Redaxa adds to every finding of this kind: If genuine, revoke or rotate it at the issuing service, update the application, then remove the exposed value from code and review Git history. Deleting it from Git does not revoke access.

Step by step: pasted a key into ChatGPT, or committed one to GitHub.

Check before you paste

The free Chrome extension runs this check inside ChatGPT, Claude, Gemini and Perplexity before a message is sent, on your device and with no daily limit. On the web you get 5 free prompt checks a day with no account.

Add the Chrome extension Try a free web check

Worried it is already in your code? Check a public GitHub repository free (3 checks a day).

Sources

Redaxa engine: scanner.ts line 186, credential-context.ts line 28 (Unknown service). Every output on this page was produced by that code when the page was built.
RFC 3986, section 3.2.1: User information
OWASP Secrets Management Cheat Sheet