Database credentials visible in the client

A connection string carries host, user and password in one line. Shipped in client code, the database becomes directly reachable — without the app, without a login, bypassing every application-level rule.

The usual path: a generator creates a database helper that belongs on the server and imports it into a client component. The bundler takes the value along; in the browser nothing looks broken.

Immediate action: rotate the database password — the old credentials must be treated as compromised. Then move access behind a server endpoint and read the string exclusively from the server environment.