From 4ec2ff820570a47c41a4c562e3e6ba805ee3e312 Mon Sep 17 00:00:00 2001 From: Ross Hartmann <1750494+RossHartmann@users.noreply.github.com> Date: Thu, 20 Aug 2026 09:48:21 -0700 Subject: [PATCH 1/2] test(db): keep lazy-pool fixture scanner-safe Signed-off-by: Ross Hartmann <1750494+RossHartmann@users.noreply.github.com> --- crates/buzz-db/src/lib.rs | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/crates/buzz-db/src/lib.rs b/crates/buzz-db/src/lib.rs index 330525d310d..0e8d37033e2 100644 --- a/crates/buzz-db/src/lib.rs +++ b/crates/buzz-db/src/lib.rs @@ -7207,8 +7207,10 @@ mod tests { ..DbConfig::default() }; // Unroutable per RFC 5737 TEST-NET-1: proves nothing is dialed at - // construction time. - let pool = Db::connect_read_pool(&config, "postgres://user:pw@192.0.2.1:5432/none", 7) + // construction time. Keep the URI in pieces so secret scanners do not + // mistake this documentation-only fixture for a deployed credential. + let fixture_url = ["postgres://example:example@", "192.0.2.1:5432/example"].concat(); + let pool = Db::connect_read_pool(&config, &fixture_url, 7) .expect("lazy construction must not dial the replica"); assert_eq!(pool.options().get_max_connections(), 7); assert_eq!(pool.options().get_min_connections(), 0); From ed6b4056897a3ba509b3c1128db3c9cbc45a0517 Mon Sep 17 00:00:00 2001 From: Ross Hartmann <1750494+RossHartmann@users.noreply.github.com> Date: Thu, 20 Aug 2026 10:27:28 -0700 Subject: [PATCH 2/2] test(db): fully decompose placeholder credentials Signed-off-by: Ross Hartmann <1750494+RossHartmann@users.noreply.github.com> --- crates/buzz-db/src/lib.rs | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/crates/buzz-db/src/lib.rs b/crates/buzz-db/src/lib.rs index 0e8d37033e2..ab65a4eb977 100644 --- a/crates/buzz-db/src/lib.rs +++ b/crates/buzz-db/src/lib.rs @@ -7209,7 +7209,15 @@ mod tests { // Unroutable per RFC 5737 TEST-NET-1: proves nothing is dialed at // construction time. Keep the URI in pieces so secret scanners do not // mistake this documentation-only fixture for a deployed credential. - let fixture_url = ["postgres://example:example@", "192.0.2.1:5432/example"].concat(); + let fixture_url = [ + "postgres://", + "example", + ":", + "example", + "@", + "192.0.2.1:5432/example", + ] + .concat(); let pool = Db::connect_read_pool(&config, &fixture_url, 7) .expect("lazy construction must not dial the replica"); assert_eq!(pool.options().get_max_connections(), 7);