lolcreds

Public credential defaults and exposure patterns for authorized security testing.

Apache CouchDB

Apache Software Foundationdatabase3 credentials

Credentials3 documented
01

Server Administrator Password

apache-couchdb / admin-password

CouchDB server administrators are configured in the last [admins] section read from ini files such as local.ini and files under local.d.

user definedsecretusername/password

Looks like

pattern
pattern

CouchDB admin section marker; admin assignments below contain passwords or password hashes

(?m)^\[admins\]\s*$
pattern

CouchDB [admins] username=password or username=hash entry; use only with [admins] context

(?m)^\s*[A-Za-z0-9_.@-]{1,128}\s*=\s*[^#;\r\n]{1,255}$

Location

environment
COUCHDB_USER, COUCHDB_PASSWORD

Official CouchDB container bootstrap admin variables

config file
local.ini, default.ini, 10-admins.ini, vm.args

CouchDB ini and runtime files; exact local.d filenames vary by deployment

secret store

Container secrets, Kubernetes Secrets, cloud secret managers, and deployment vaults

source code

Docker Compose files, Helm values, tests, and accidentally committed local.ini files

logs

Startup errors, setup logs, and provisioning traces that reveal admin configuration

public interface
tcp/5984, /_utils/, /_session

CouchDB HTTP API and Fauxton login endpoint

Notes

There is no universal CouchDB admin password. local.d/*.ini is intentionally not used as a scanner path because template globs are out of scope.

02

_users Database Password

apache-couchdb / user-database-password

CouchDB stores regular users separately from server administrators in the _users database. Users authenticate to CouchDB HTTP APIs with configured auth handlers.

user definedsecretusername/password

Location

database
_users

CouchDB users database containing user documents and password material

http header
Authorization

Basic or Bearer authentication accepted by configured CouchDB auth handlers

config file
local.ini, default.ini

CouchDB authentication handler and proxy/JWT/cookie configuration

secret store

Password vaults, CI/CD variables, and cloud secret managers

source code

Replication scripts, application clients, tests, and committed URLs

logs

HTTP access logs, replication errors, and client debug output

Scope

Authorized use

LOLCreds helps map the credential surface of real products: known defaults, generated values, credential locations, and exposure patterns.