SH208: Database password written in Django settings

Severity: high · Category: secrets · Applies to: django

Why it matters

A database password in settings.py is committed with the code and readable by everyone with repository access.

How to fix

Read the password from an environment variable, for example os.environ['DB_PASSWORD'].

Ignoring this rule

Skip it everywhere in devshield.yml:

ignore:
  - SH208

Or skip one line with a comment on that line or the line above:

devshield-ignore: SH208