Secret Written Into the Compose File

Why it matters

Compose files live in git next to the code, so a literal value there is in every clone and in the history. Compose reads ${VARIABLE} from the shell or a .env file that is not committed, which keeps the same workflow and takes the secret out of the repository.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

services:
  db:
    image: postgres:16
    environment:
      POSTGRES_PASSWORD: Sup3rSecretPass

The smallest fix

services:
  db:
    environment:
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set in .env}
# .env (git-ignored)
POSTGRES_PASSWORD=<real value>

The better fix

If you have a few more minutes, this is the approach that holds up as the app grows.

# Use Docker secrets for Swarm, or the secrets: top-level element with
# file-based secrets, so values are mounted as files instead of
# environment variables visible in `docker inspect`.

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

How to check the fix worked

1. Run `docker compose config` without the variable set and confirm it
   fails with the "set in .env" message.
2. Set it and confirm the service starts.

Further reading

• https://cwe.mitre.org/data/definitions/798.html
• https://docs.docker.com/compose/environment-variables/