Checks · PORT-001

PORT-001 · Database port publicly reachable

Why it matters

An open database port lets the internet try passwords against Postgres, MySQL, Mongo or Redis.

How we detect it

After you prove you own the site, a TCP connect is attempted on a fixed list of database ports.

How we fix it

Close the port at the firewall. This is host configuration, not a code change.

Can it be fixed automatically? Instructions only

Related checks

• SEC-001 · Secret committed in repo (current tree)
• SEC-002 · Secret in git history
• SEC-003 · Service-role or secret key in client bundle
• SEC-004 · Public env prefix on a secret