# Default-credential check — does a chart's default base ship a fixed shared password?

**UNOFFICIAL/EXPERIMENTAL.** Live receipt generated by `scripts/run-default-credential-check.mjs`; do not hand-edit. Regenerate with `npm run default-credential:check`.

**Claim.** A package default must not ship the same baked password to every user. This check renders each default base twice and fails if the password bytes are identical across installs. Fixed-password demo bases can exist only when they are explicit, non-default choices.

Helm generates a **random** password per install. cub renders **deterministically** and may ship an auth Secret in `out/secrets/`. If that value is **identical for every install** (same across namespaces, committed in the package), it is a shared default credential. Found by rendering each default base with two namespaces and comparing the Secret values.

**Default bases shipping a FIXED credential: 0/12 (0%). Bases still named `generated-passwords`: 0.** Overall: **pass**.

## The fixed default credentials

| Chart | Default base | Fixed Secret(s) — placeholder shown where committed |
| --- | --- | --- |
| — | — | none — no fixed default credentials |

This is a footgun, not a vulnerability per se: fixed values may be committed placeholders meant for render-parity demos. The safe default is an existing-Secret base that renders no credential and gives the user a command for generating fresh Secret material before apply.

## Per chart

| Chart | Status |
| --- | --- |
| bitnami/nginx/24.0.2@http-clusterip | no-secret |
| bitnami/redis@reuse-existing-secret | no-secret |
| bitnami/mysql@existing-secret | no-secret |
| bitnami/mongodb@existing-secret-replicaset | no-secret |
| bitnami/rabbitmq@existing-secret | no-secret-data |
| bitnami/postgresql@existing-secret | no-secret |
| bitnami/apache@default | no-secret |
| bitnami/memcached@default | no-secret |
| bitnami/zookeeper@default | no-secret |
| bitnami/contour@default | no-secret |
| bitnami/opensearch@default | no-secret |
| bitnami/phpmyadmin@default | no-secret |

- Companion to the cub-installer fuzz's namespace findings — this is the **secret** rough edge. Receipt: `runs/default-credential-check/receipt.yaml`.