Lets say I want to develop a website with a community, and so I want it to be open source. However, this website isn't going to be static.

However, it seems that revealing the database connections and the queries made is insecure, as the database name, username, and password are all part of the code.

How is sensitive information kept secure on an open-source website?

  • I've unfortunately seen far too insecure code for a webpage on several open source repositories in the past, mainly SQL injection vulnerabilities. Just please make sure you filter user input.
    – Alejandro
    Dec 15 '14 at 18:36

The database login credentials should not be part of your sourcecode. They should be part of the configuration files. The production version of these configuration files should not be part of the official codebase. You should only publish an example configuration with example parameters.

This is not just recommended from a security perspective, it also makes it much easier for others to use your project. They will definitely have other login credentials than you do, so providing a config file where they can enter them is much more comfortable than digging through the source and replacing all references to them.

For more information, check the question "Strategy for keeping secret info such as API keys out of source control?" on programmers stackexchange


You can use a combination of HTML page + Servlet at backend to connect the database This will definitely be sound and secure than the one you are using now

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.