[SECURITY] S2 — Hardcoded Postgres password in config.py:76

[cluster2600]

Summary

Hardcoded Postgres password 'elvis_password' found in config/config.py line 76.

Risk

HIGH — Database credentials exposed in source code. Anyone with repo access can connect to the DB directly.

Location

# config/config.py:76
POSTGRES_PASSWORD = 'elvis_password'

Fix

POSTGRES_PASSWORD = os.environ.get('POSTGRES_PASSWORD') or vault.get_secret('postgres/password')
if not POSTGRES_PASSWORD:
    raise RuntimeError('POSTGRES_PASSWORD not set')

Sprint

Sprint 1 — Story 1.2 (Security Hardening)

Found by PM agent audit — Feb 17, 2026