Aimed at what a migration produces rather than at a repository: a drush sql:dump carries every
user's password hash, a settings.php carries the database password and the hash salt, and both
routinely end up in a directory that becomes a publicly served asset. Values are never printed --
a report that quoted the match would move the credential into a terminal and a CI log.
Scans migration artifacts for credentials.
Aimed at what a migration produces rather than at a repository: a
drush sql:dumpcarries every user's password hash, asettings.phpcarries the database password and the hash salt, and both routinely end up in a directory that becomes a publicly served asset. Values are never printed -- a report that quoted the match would move the credential into a terminal and a CI log.