{"record":{"id":"6c94fabaa9ccec9b","repo":"JuliusBrussee/caveman","slug":"postgres-production-connection-includes-a-plainte","errorCode":null,"errorMessage":"postgres: production connection includes a plaintext fallback","messagePattern":"postgres: production connection includes a plaintext fallback","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shared/platform/postgresconfig/postgresconfig.go","lineNumber":68,"sourceCode":"\t\treturn nil, fmt.Errorf(\"postgres: %s or %s is required in production\", caEnvironment, caFileEnvironment)\n\t}\n\tif caPEM == \"\" {\n\t\treturn config, nil\n\t}\n\troots := x509.NewCertPool()\n\tif !roots.AppendCertsFromPEM([]byte(caPEM)) {\n\t\treturn nil, fmt.Errorf(\"postgres: %s contains no valid certificate\", caEnvironment)\n\t}\n\tif config.ConnConfig.TLSConfig == nil {\n\t\treturn nil, errors.New(\"postgres: CA certificate configured while TLS is disabled\")\n\t}\n\tconfig.ConnConfig.TLSConfig.RootCAs = roots\n\tconfig.ConnConfig.TLSConfig.InsecureSkipVerify = false\n\tconfig.ConnConfig.TLSConfig.ServerName = config.ConnConfig.Host\n\tfor _, fallback := range config.ConnConfig.Fallbacks {\n\t\tif fallback.TLSConfig == nil {\n\t\t\tif production {\n\t\t\t\treturn nil, errors.New(\"postgres: production connection includes a plaintext fallback\")\n\t\t\t}\n\t\t\tcontinue\n\t\t}\n\t\tfallback.TLSConfig.RootCAs = roots\n\t\tfallback.TLSConfig.InsecureSkipVerify = false\n\t\tfallback.TLSConfig.ServerName = fallback.Host\n\t}\n\treturn config, nil\n}\n\nfunc caPEMFromEnvironment() (string, error) {\n\tfilePath := strings.TrimSpace(os.Getenv(caFileEnvironment))\n\tdirect := strings.TrimSpace(os.Getenv(caEnvironment))\n\tif filePath != \"\" && direct != \"\" {\n\t\treturn \"\", fmt.Errorf(\"postgres: set only %s or %s, not both\", caFileEnvironment, caEnvironment)\n\t}\n\tif filePath == \"\" {\n\t\treturn direct, nil","sourceCodeStart":50,"sourceCodeEnd":86,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/27d5a3981a347890211bb1bf2439e5c821a63bc9/shared/platform/postgresconfig/postgresconfig.go#L50-L86","documentation":"Error \"postgres: production connection includes a plaintext fallback\" thrown in JuliusBrussee/caveman.","triggerScenarios":"Thrown at shared/platform/postgresconfig/postgresconfig.go:68 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Remove the plaintext fallback from the production connection config."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"27d5a3981a347890211bb1bf2439e5c821a63bc9","analyzedAt":"2026-08-15T09:26:11.751Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}