fix(scan): stop reporting a DSN whose password slot is a template

[ralyodio]

What

secret-database-url fires on any connection string with a credential segment before the @. It does not check what sits in that segment, so a tool whose job is building DSNs gets one high per profile.

terrablue/devdb is the clean example — 9 files, 4 findings, all high, all in profiles.go, and all of them the template strings that are the repository's entire point:

dsn: "postgres://{{.user}}:{{.pass}}@{{.host}}:{{.port}}/{{.name}}"
dsn: "mongodb://{{.user}}:{{.pass}}@{{.host}}:{{.port}}/{{.name}}"
dsn: "redis://:{{.pass}}@{{.host}}:{{.port}}"

Zero true positives on the only file that matters, at high. Any CI gate is red on day one.

The fix

KNOWN_PLACEHOLDERS gains one pattern: a credential segment whose password slot is an interpolation — {{…}}, ${…}, $VAR, %s/%d/%v.

This is a stronger claim than the user:pass exemption next to it, not a looser one. That rule reads English metasyntactic words and infers intent. An interpolation cannot occur in a credential at all: the value that reaches the driver is whatever the template engine substitutes, so there is nothing in the file to leak.

The username is not a credential, so only the password slot decides it:

DSN	Before	After
postgres://{{.user}}:{{.pass}}@host/db	high	exempt
redis://:{{.pass}}@host:6379	high	exempt
mysql://${DB_USER}:${DB_PASS}@host/app	high	exempt
postgres://{{.user}}:hunter2@host/db	high	still high
postgres://devdb:Kd93mQpZx2@{{.host}}/devdb	high	still high

The last two rows are the cases this must not swallow, and they are asserted.

Verification

• New packages/scan/src/__tests__/devdb-regression.test.ts, following limen-regression.test.ts — 4 tests, 2 of them guarding real credentials.
• Full scan suite: 351 passing, 15 files. tsc --noEmit clean.
• End-to-end through the built CLI: devdb 4 findings → 0.

Scope

Only the DSN rule. It does not touch the AWS-key reasoning deliberately excluded from KNOWN_PLACEHOLDERS, and it drops nothing that carries an actual value.

🤖 Generated with Claude Code

https://claude.ai/code/session_017CnhqMwFo6ceywCRLdU2EG

[github-actions]

ThreatCrush Security Scan

12 finding(s)

HIGH/CRITICAL: 1 | MEDIUM: 6 | LOW: 5

Severity	Rule	Location
HIGH	secret-aws-access-key	prd/0003-detect-hardcoded-secrets-before-they-are-committed-or-served.md:126
MEDIUM	js-open-redirect	apps/web/src/app/auth/login/page.tsx:50
MEDIUM	js-unescaped-html-sink	apps/web/src/app/hire/page.tsx:96
MEDIUM	js-unescaped-html-sink	apps/web/src/app/hire/page.tsx:100
MEDIUM	js-open-redirect	apps/web/src/components/funding/FundingClient.tsx:97
MEDIUM	js-unescaped-html-sink	apps/web/src/components/GuideReader.tsx:265
MEDIUM	js-uninitialized-buffer	packages/scan/src/node-rules.ts:456
LOW	secret-generic-credential	PRD.md:269
LOW	tls-verification-disabled	prd/0004-find-dangerous-code-patterns-without-pretending-to-be-a-compiler.md:121
LOW	tls-verification-disabled	prd/0004-find-dangerous-code-patterns-without-pretending-to-be-a-compiler.md:122
LOW	sh-remote-script-execution	scripts/smoke-test.sh:47
LOW	secret-aws-access-key	scripts/smoke-test.sh:112

Snippets are redacted; ThreatCrush never prints matched credential material.