From 4dc3251ade7105474359892c610ef6e7f1a4d708 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Wed, 22 Apr 2026 15:37:15 +0000
Subject: [PATCH] security: remove hardcoded database credentials from
 appsettings.json

- Replace plaintext SQL Server password in appsettings.json with a
  placeholder string that fails loudly if used accidentally
- Add UserSecretsId to Beam.Server.csproj to enable .NET User Secrets
  for local development (dotnet user-secrets set ...)
- Update .gitignore to block appsettings.Production.json and
  appsettings.Staging.json from being committed, preventing future
  credential leaks via environment-specific settings files

The committed password should be treated as compromised and rotated.
For local dev, supply the real connection string via user secrets:
  cd Beam.Server
  dotnet user-secrets set "ConnectionStrings:DefaultConnection" "<real-conn-string>"
For production/CI, use an environment variable:
  ConnectionStrings__DefaultConnection=<value>

Closes #13

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .gitignore                     | 4 ++++
 Beam.Server/Beam.Server.csproj | 1 +
 Beam.Server/appsettings.json   | 2 +-
 3 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 030522d..f725038 100644
--- a/.gitignore
+++ b/.gitignore
@@ -214,6 +214,10 @@ UpgradeLog*.htm
 *.mdf
 *.ldf
 
+# Environment-specific settings that may contain secrets
+appsettings.Production.json
+appsettings.Staging.json
+
 # Business Intelligence projects
 *.rdl.data
 *.bim.layout
diff --git a/Beam.Server/Beam.Server.csproj b/Beam.Server/Beam.Server.csproj
index 4831e91..a60d4ae 100644
--- a/Beam.Server/Beam.Server.csproj
+++ b/Beam.Server/Beam.Server.csproj
@@ -4,6 +4,7 @@
     <TargetFramework>net6.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
+    <UserSecretsId>beam-server-dev</UserSecretsId>
   </PropertyGroup>
 
   <ItemGroup>
diff --git a/Beam.Server/appsettings.json b/Beam.Server/appsettings.json
index 76af5f0..5e417d9 100644
--- a/Beam.Server/appsettings.json
+++ b/Beam.Server/appsettings.json
@@ -1,5 +1,5 @@
 {
   "ConnectionStrings": {
-    "DefaultConnection": "Data Source=sql;Initial Catalog=Beam;Integrated Security=False;User ID=sa;Password=@#^!fcIen&*asd"
+    "DefaultConnection": "REPLACE_WITH_USER_SECRET_OR_ENV_VAR"
   }
 }