The password you set while debugging

One easy security mistake you can do while developing is when you are debugging, ie local database or a service that needs a password to setup. The following usually happens, your attention is on the bug or the problem, so you type something like password and admin for the credentials. Of course your idea is that you will replace that later. Your docker-compose.yml file will be in a good shape for production after all. But sometimes, later doesn't come at all.

This is not a knowledge problem, you probably know that a weak passwords are dangerous. But your mental model and state is super focused for getting back into the task in hand, and choosing a good password quickly seems like a detour from this focus. This can be said also about your port being available in your docker-compose.yml sand saying, I will comment or remove the port part once I setup the TLS termination later.

The problem is that usually you get to fix the problem, then you are happy and want now to move into production, you have something that works, adrenaline (or dopamine if it is a good hobby like self-hosting ) rushes and you are one minute aways from exposing the service using weak credentials. The service would be running the whole time, and its port is often more reachable than you think it is.

We all know that Docker would publish the port on every network interface by default and it punches a hole into your firewall by default too. So a container that you think is still available only locally, might be happily available on a network or sometimes the whole Internet. Okay, now you will have scanners looking for open database ports in the whole IPv4 space that probe everything coming and discovering your little mistake often quicker than the time you would need to figure out that you did a mistake.

But this habit carries on, the password password you typed for your local PostgreSQL shows up into a test/dev VM or shared lab machine. Because this is what your fingers and working memory is used to when your focus is away.

What makes this work is that this risk lies outside the problem your are trying to solve. You can spend too many hours chasing a memory leak and then introduce an actual vulnerability through a password you chose in two seconds. This usually happens because we underestimate the decisions we make outside our focus window in general. When we are deep into focus mode, practices that we usually follow becomes harder and problems we usually catch slips easily.

But what is the fix? I don't know because I cannot think of a technical way that would prevent you from shooting yourself in the foot. Maybe using secret manager and block secrets in .env and docker-compose.yml files ...etc would help? Maybe but that would need some discipline and good system design from the beginning.