05/02/2026 updated code for security 5

scripts/backup_db.sh

@@ -56,11 +56,14 @@ log "INFO  Starting backup → $BACKUP_FILE"
 # --single-transaction: consistent snapshot without locking (InnoDB)
 # --routines --events:  include stored procedures/events if any
 # --no-tablespaces:     avoid PROCESS privilege requirement on MySQL 8+
-mysqldump \
+#
+# MYSQL_PWD is used instead of --password so the credential never appears in
+# the process list (ps aux) where any user on the server could read it.
+# mysqldump and the mysql client both honour MYSQL_PWD natively.
+MYSQL_PWD="$DB_PASS" mysqldump \
     --host="$DB_HOST" \
     --port="$DB_PORT" \
     --user="$DB_USER" \
-    --password="$DB_PASS" \
     --single-transaction \
     --routines \
     --events \
@@ -82,4 +85,4 @@ DELETED=$(find "$BACKUP_DIR" -maxdepth 1 -name 'passkeeper_*.sql.gz' \
     -mtime +"$RETENTION_DAYS" -print -delete | wc -l)
 log "INFO  Retention cleanup: removed $DELETED file(s) older than ${RETENTION_DAYS} days"
 
-log "INFO  Backup finished successfully"
+log "INFO  Backup finished successfully"