security: hardening по результатам аудита безопасности

pkg/adapters/config/config.go

@@ -55,7 +55,6 @@ func RegisterFlags(cmd *cobra.Command) {
 	flags.String("pg-host", "", "PostgreSQL host")
 	flags.Int("pg-port", 0, "PostgreSQL port")
 	flags.String("pg-user", "", "PostgreSQL user")
-	flags.String("pg-password", "", "PostgreSQL password")
 	flags.String("pg-database", "", "PostgreSQL database name")
 	flags.String("pg-sslmode", "", "PostgreSQL SSL mode")
 	flags.StringSlice("pg-exclude-tables", nil, "PostgreSQL tables to exclude from backup")
@@ -94,7 +93,6 @@ func Load(cmd *cobra.Command) (*Config, error) {
 		_ = v.BindPFlag("pg.host", cmd.Flags().Lookup("pg-host"))
 		_ = v.BindPFlag("pg.port", cmd.Flags().Lookup("pg-port"))
 		_ = v.BindPFlag("pg.user", cmd.Flags().Lookup("pg-user"))
-		_ = v.BindPFlag("pg.password", cmd.Flags().Lookup("pg-password"))
 		_ = v.BindPFlag("pg.database", cmd.Flags().Lookup("pg-database"))
 		_ = v.BindPFlag("pg.sslmode", cmd.Flags().Lookup("pg-sslmode"))
 		_ = v.BindPFlag("pg.exclude_tables", cmd.Flags().Lookup("pg-exclude-tables"))
@@ -151,6 +149,10 @@ func Load(cmd *cobra.Command) (*Config, error) {
 	v.SetEnvPrefix("APP")
 	v.SetEnvKeyReplacer(strings.NewReplacer(".", "_", "-", "_"))
 	v.AutomaticEnv()
+	// pg.password is intentionally not exposed as a CLI flag (CWE-214), but
+	// must still be loadable from APP_PG_PASSWORD. Viper needs an explicit
+	// BindEnv for a nested key that has no bound flag.
+	_ = v.BindEnv("pg.password")
 
 	var cfg Config
 	if err := v.Unmarshal(&cfg); err != nil {