Hardcoded Connection String Audit for Azure IoT Hub (azure-iot-toolkit) + 7 More VS Code Stacks — 26 rules, 32 snippets

There are two kinds of credential in a repository, and only one of them gets caught.

The first kind is a token a cloud provider issued: a GitHub PAT, an AWS access key, a Stripe key. These have a shape. GitHub's free secret scanning knows that shape, matches it, and tells the provider to revoke it. That system works, and it is free on public repositories.

The second kind is the one you typed yourself:

Server=tcp:reporting.database.windows.net,1433;Database=reporting;User Id=svc_reader;Password=Sup3rSecret!;
TrustServerCertificate=true

No provider issued that password. It has no shape. Nobody can revoke it for you. On GitHub's free tier it is not a partner pattern, so nothing flags it — generic and unstructured secret detection lives inside GitHub Secret Protection, published at $19 per active committer per month, and even then it reports *after* the push has landed.

That second line is worse than the first, and it never gets discussed. TrustServerCertificate=true tells the driver to accept any certificate presented to it. The connection still says "encrypted". It is encrypted to whoever is standing in the middle.

The five that get through

These are all generic patterns. None of them is a partner token, so none of them trips a free scanner:

// 1. an IoT Hub device identity anyone who clones the repo can impersonate
HostName=my-hub.azure-devices.net;DeviceId=sensor-01;SharedAccessKey=aBcD...uvwx=

// 2. a cluster-admin certificate that is not tied to a person and cannot be revoked per-user
az aks get-credentials --resource-group rg --name prod --admin

// 3. a credential that travels into every proxy log and error page that copies the URL
mongodb://admin:[email protected]/db

And in R, where the whole thing gets rendered into an HTML report and emailed:

Sys.setenv(IOTHUB_SAS_TOKEN = "SharedAccessSignature sr=...&sig=...")
con <- DBI::dbConnect(odbc::odbc(), password = "letmein")

What to write instead

Every one of these has a boring, correct form. The point is not that it is hard — it is that you have to remember it at 6pm on the day the build has to be green:

var connectionString = Environment.GetEnvironmentVariable("SQL_CONNECTION_STRING")
    ?? throw new InvalidOperationException("SQL_CONNECTION_STRING is not set.");

token <- Sys.getenv("IOTHUB_SAS_TOKEN")
if (!nzchar(token)) stop("IOTHUB_SAS_TOKEN is not set. Add it to .Renviron, which stays out of git.")

Checking it before the push, not after

Connection String & Secret Audit is a VS Code extension carrying 26 rules and 32 safe-replacement snippets across 8 stacks — Azure IoT Hub, SQL Server, SQLTools, AKS and Kubernetes, .NET MAUI, Java MicroProfile, R, and R Markdown or Quarto.

Auditing the file you have open is free and needs no key, no account, and no upload. It matches all 26 rules, prints each finding with its line number, and any of the 32 snippets drops the environment-variable form in at your cursor. That is the whole job for one file, finished.

What a licence adds is scale and handover: the same audit across every file in the workspace instead of one, and the findings written out as a CSV, JSON or HTML file you keep in the repo and hand to a reviewer. One-time $29, against $19 per committer per month for the hosted equivalent.

Nothing is sent anywhere. The rules run in your editor, on your machine, on a file that has not been pushed yet — which is the only moment any of this is still fixable.