Push this scan report to juspay/hyperswitch

Embedded score card image

This image will render at the top of the issue body. Hosted on Repobility, refreshes automatically after re-scans.

Issue title

Hi @juspay, an automated scan of this repository surfaced **201 code-quality findings** that may be worth a look. 
Full details, severity filters, and per-file context are at the link below — feel free to close this issue if it isn't useful to you.

## Full interactive report

**https://repobility.com/scan/9c39f054-10cb-4584-aa89-251222603de5/**

![Live scan page](https://repobility.com/scan/9c39f054-10cb-4584-aa89-251222603de5/report.png?v=1778986684)

## At a glance

- **Score**: `69/100`  •  **Grade**: `B+`
- **Scanned**: `2026-05-17 02:58 UTC`
- **Lines of code**: 2,263,232
- **Total findings**: 201
- **Security-tagged**: 2
- **Credential / secret patterns**: 5

## Top issues, with file & line

_These are deterministic rule-based findings — the file paths and line numbers below are real and can be verified in your tree._

1. **[critical]** [SEC022] Database URL With Embedded Credential: A database connection URL contains an embedded username and password. These URLs are often copied into defaults, docs, and scripts, then leak working credentials. — `crates/hsdev/src/input_file.rs:22`
   _Remove the embedded password, require the URL from a secret store or environment variable, and rotate the database credential._
2. **[critical]** [SEC010] Cloud Provider Token: Cloud provider or SaaS API token found in source code. — `crates/common_enums/src/enums.rs:6565`
   _Remove immediately and rotate the token. Use environment variables._
3. **[critical]** [SEC022] Database URL With Embedded Credential: A database connection URL contains an embedded username and password. These URLs are often copied into defaults, docs, and scripts, then leak working credentials. — `crates/analytics/src/sqlx.rs:45`
   _Remove the embedded password, require the URL from a secret store or environment variable, and rotate the database credential._
4. **[critical]** [SEC010] Cloud Provider Token: Cloud provider or SaaS API token found in source code. — `crates/hyperswitch_connectors/src/utils.rs:34`
   _Remove immediately and rotate the token. Use environment variables._
5. **[critical]** [SEC022] Database URL With Embedded Credential: A database connection URL contains an embedded username and password. These URLs are often copied into defaults, docs, and scripts, then leak working credentials. — `crates/common_utils/src/lib.rs:324`
   _Remove the embedded password, require the URL from a secret store or environment variable, and rotate the database credential._

See all 201 findings, with severity filters and AI fix prompts: **https://repobility.com/scan/9c39f054-10cb-4584-aa89-251222603de5/**

---

**What is this?** [Repobility](https://repobility.com) is a research project that scans public repositories with a multi-layer static analyzer (rule-based, no AI hallucinations) and learns code-quality patterns across a broad cross-repo corpus. This is **not a sales pitch** — there's no paywall, no signup required to view the report, and no payment ask. If the findings aren't useful, please close this issue and we won't post again.

**To re-run after fixes land:** paste your repo URL at [repobility.com](https://repobility.com) — fresh scan, free.

_Issue filed via the public Repobility report at https://repobility.com/scan/9c39f054-10cb-4584-aa89-251222603de5/._