Api Key Exposure in Hanami with Cockroachdb

In Hanami applications that connect to Cockroachdb, API key exposure often arises from how database credentials and connection strings are managed and logged. Hanami, by default, loads environment variables into its configuration and passes them to the underlying database driver. If a developer accidentally commits a database.yml or equivalent configuration containing the Cockroachdb connection string with embedded credentials to version control, the API key (often a username/password or client certificate) becomes part of the repository history and potentially exposed via source code visibility.

When the application starts, Hanami establishes a connection to Cockroachdb using a URI such as cockroachdb://user:password@host:26257/defaultdb?sslmode=require. If this URI is constructed dynamically using environment variables that are printed to logs or exposed through error messages (for example, in a rescue block that logs the full connection URI), the API key can be leaked to anyone with access to application logs or crash reports.

The risk is compounded because Cockroachdb often runs in distributed or cloud environments where endpoints are publicly reachable. Without strict network controls or authentication, an exposed connection string can allow unauthorized access to sensitive data. Furthermore, Hanami’s convention-over-configuration approach may lead developers to omit explicit credential handling, relying on defaults that inadvertently expose sensitive information in stack traces or monitoring output.

During a middleBrick scan, findings related to this pattern may surface under Data Exposure and Authentication checks. The scanner detects that connection strings or credentials appear in observable surfaces such as logs, error pages, or unauthenticated endpoints. This does not imply that middleBrick can view your database contents, but it highlights that the API key used to reach Cockroachdb is not being adequately isolated from public-facing attack surfaces.

To illustrate, consider a typical Hanami initializer that sets up the database connection:

require 'hanami/setup'
require 'hanami/model'

Hanami::Model.configure do
  # WARNING: embedding credentials directly is unsafe
  url 'cockroachdb://root:[email protected]:26257/app_production?sslmode=require'
end

Hanami::Model.relation(:users)
Hanami::Model.migration.up

In this example, the API key (the password secret123) is hardcoded. If the application raises an unhandled exception and the full configuration is included in the error report, the key is exposed. A safer approach uses environment variables and avoids logging the full URI.

Remediation focuses on ensuring that the Cockroachdb connection string and API keys never appear in source code, logs, or error output. Use environment variables and a secure configuration loader, and ensure that any logging in Hanami filters out sensitive connection details.

First, define your connection URI using environment variables, and validate their presence at startup:

require 'hanami/setup'
require 'hanami/model'

database_url = ENV.fetch('COCKROACHDB_DATABASE_URL')
raise 'COCKROACHDB_DATABASE_URL must be set' if database_url.nil? || database_url.empty?

Hanami::Model.configure do
  url database_url
end

Hanami::Model.relation(:users)
Hanami::Model.migration.up

Set the environment variable externally, for example:

export COCKROACHDB_DATABASE_URL='cockroachdb://${DB_USER}:${DB_PASSWORD}@${DB_HOST}:26257/${DB_NAME}?sslmode=require'

Second, override logging in Hanami to prevent connection details from appearing in logs. Configure the model logger to suppress sensitive data:

# config/initializers/logging.rb
if defined?(Hanami::Model)
  Hanami::Model.logger = Logger.new($stdout)
  Hanami::Model.logger.level = Logger::INFO

  # Prevent logging of connection setup details
  original_connect = Hanami::Model::Adapter::Connection.instance_method(:connect)
  Hanami::Model::Adapter::Connection.define_method(:connect) do
    Hanami::Model.logger.info 'Connecting to database (credentials omitted)'
    original_connect.bind(self).call
  end
end

Third, use Cockroachdb’s built-in role-based access control to limit what the API key can do, even if exposed. Create a dedicated user with minimal privileges:

-- In Cockroachdb SQL, executed by an admin
CREATE USER hanami_app WITH PASSWORD 'strong_password_here';
GRANT SELECT, INSERT, UPDATE ON TABLE users TO hanami_app;
REVOKE ALL ON DATABASE system FROM hanami_app;

Finally, integrate middleBrick into your workflow using the CLI or GitHub Action to detect any remaining exposure of credentials in your API surface. The scanner checks for authentication weaknesses and data exposure patterns that could allow an attacker to leverage an exposed Cockroachdb connection string.

For ongoing protection, use the Pro plan to enable continuous monitoring and CI/CD integration, so that any future commit containing a hardcoded URI fails the build before reaching production.