language: go
name: go_postgres_config_raw_passwd
message: "Do not hardcode PostgreSQL passwords in the source code."
category: security
severity: critical
pattern: >
  [
    (composite_literal
  type: (qualified_type
    package: (package_identifier) @pkg
    name: (type_identifier) @type
    (#match? @pkg "^pg$")
    (#match? @type "^Options$"))
  body: (literal_value
    (keyed_element
      (literal_element) @field
      (literal_element 
        (interpreted_string_literal) @value)
      (#match? @field "^Password$")))) @go_postgres_config_raw_passwd
  ]
exclude:
  - "test/**"
  - "*_test.go"
  - "tests/**"
  - "__tests__/**"
description: |
  Hardcoding PostgreSQL passwords in source code exposes sensitive information, 
  increasing the risk of unauthorized access, especially if the code is stored 
  in version control systems.

  Why this is a problem:
  - Compromised source code leads to database breaches.
  - Credentials in repositories can be scanned and exploited by attackers.

  Remediation Steps:
  1. Use environment variables to manage sensitive data:
     ```go
     import "os"

     options.Password = os.Getenv("PG_PASSWORD")
     ```
  2. Use a secure secret management service (e.g., HashiCorp Vault, AWS Secrets Manager).
  3. Ensure `.env` files and other sensitive configurations are excluded from version control via `.gitignore`.