A password is in the sources

Symptom: check or build ends with exit code 2 and “A password (PWD=) is written into the source”, naming a file and line. A password that exists only in the database is not found before it is exported: commit checks the sources before its export (see Commit from Access).

All versions of the WKL Office SDK. Scanned are the objects (queries, forms, reports, modules, macros), the table data, the ribbons and the models; not scanned are references.json, application/properties.json, the table schemas and the themes.

A connection text holds a password with its value (PWD=... or Password=...), for example in a pass-through query or a VBA connection string. Everybody who can read the repository can read it, and every clone and CI log carries it.

1. Remove the value from the source, and let the application get it at run time: Windows sign-in (Trusted_Connection=Yes), a prompt, or the Linked Tables Manager of WKL Forms Object Library, which keeps connections without passwords.
2. An empty value (PWD=;) and a placeholder (PWD={password}, $(Password)) are accepted. The check takes every value that starts with { or contains $ anywhere for a placeholder, so PWD={s3cret} (an ODBC password in braces) or PWD=Pa$$w0rd passes it.
3. Change the password on the server: it has been in the files.

• What the check does not find. It looks for PWD= or Password= followed by a value. It does not report a value that starts with a quotation mark or an apostrophe (PWD="secret", PWD='secret', also the start of a VBA string expression), a value that starts with { or contains $, a password under another key, or one built at run time. A clean check is therefore no proof that the sources hold no password.
• A VBA statement that assigns a variable or property of that name (m_Password = Value, Me.Password = txtPwd) is code, not a connection text, and is not reported.

A path into a user profile (C:\Users\<name>\...) is reported as a warning only: it exists on that machine for that user; replace it with a path every machine has.