sec(jobs): pass pg_dump password via PGPASSWORD env, not argv

Closes SEC-WORKER FINDING-1 (CWE-214, P1) + FINDING-2 (CWE-214, P1).

Both pg_dump call-sites embedded the connection password in the URL on
argv:

  - platform_db_backup.go:631  — daily 02:00 UTC platform DB backup
                                  (leaks the doadmin password)
  - customer_backup_runner.go:108 — hourly Pro/Team customer backup
                                     (leaks the customer's DB password,
                                      decrypted from AES-GCM ciphertext)

argv is world-readable via /proc/<pid>/cmdline for the entire backup
window (multi-minute on the platform DB). Any sidecar / debug shell /
log-shipper / kube-exec process — and any crash-dump archived by
`kubectl describe` — captures the secret.

Fix: tiny helper `splitPGPassword(url) → (urlWithoutPW, password, err)`
strips the password from the URL userinfo. Both call-sites set
`PGPASSWORD=<pw>` on cmd.Env (alongside the parent env) so libpq picks
it up out-of-band. URL on argv no longer contains the password.

Fail-open posture: if URL parse fails (malformed connection_url), fall
back to the original URL on argv — better than wedging every customer's
backup ladder over one operator typo. Today's URLs are constructed by
the provisioner from validated identifiers so this path is purely
defensive.

Production LOC delta: 62 (helper 58 + 4 imports/edits per site).

Tests:
  - TestSplitPGPassword (6 subcases: userpass, user-only, no-userinfo,
    empty, percent-encoded password, malformed-URL-fail-open)
  - TestSplitPGPassword_NoLeak: literal password substring MUST NOT
    appear in returned URL (THE regression guard for this fix)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: mastermanas805

internal/jobs/customer_backup_runner.go

@@ -50,6 +50,7 @@ import (
 	"io"
 	"log/slog"
 	"net/http"
+	"os"
 	"os/exec"
 	"strings"
 	"time"
@@ -105,11 +106,25 @@ type pgDumpRunner interface {
 type realPgDumpRunner struct{}
 
 func (realPgDumpRunner) Run(ctx context.Context, connURL string, w io.Writer) error {
+	// SEC-WORKER FINDING-2 (2026-05-29): split the customer's DB password
+	// out of the URL into PGPASSWORD env so it does NOT sit in argv (and
+	// therefore /proc/<pid>/cmdline + `ps aux` + kubectl describe crash
+	// archive) for the entire hourly backup window. Fail-open on parse
+	// error to avoid a single malformed connection_url stalling every
+	// customer's backup ladder.
+	dsn, pw, splitErr := splitPGPassword(connURL)
+	if splitErr != nil {
+		dsn = connURL
+		pw = ""
+	}
 	cmd := exec.CommandContext(ctx, "pg_dump",
 		"--no-owner", "--no-acl",
 		"--format=custom",
-		"-d", connURL,
+		"-d", dsn,
 	)
+	if pw != "" {
+		cmd.Env = append(os.Environ(), "PGPASSWORD="+pw)
+	}
 	cmd.Stdout = w
 	// Stderr goes to slog at the call site by buffering — we don't want a
 	// noisy pg_dump banner ("dumping contents of table ...") to flood

internal/jobs/pgpw.go

@@ -0,0 +1,59 @@
+package jobs
+
+// pgpw.go — small helper used by every pg_dump call-site to pass the
+// Postgres password out-of-band (via PGPASSWORD env) instead of inside the
+// process-args connection URI.
+//
+// SEC-WORKER FINDING-1 + FINDING-2 (2026-05-29):
+//   - platform_db_backup.go ran `pg_dump <DSN-with-password>` for the
+//     daily 02:00 UTC platform-DB backup. The DSN with embedded
+//     doadmin password was visible in `ps aux` / /proc/<pid>/cmdline for
+//     the entire multi-minute backup window — any sidecar / debug shell /
+//     log-shipper / `kubectl describe` crash dump could read it.
+//   - customer_backup_runner.go ran `pg_dump -d <DSN-with-password>` for
+//     every per-customer hourly Pro/Team backup. Same surface, but the
+//     leaked secret is the customer's DB password (decrypted from
+//     resources.connection_url AES-GCM ciphertext).
+//
+// libpq honors PGPASSWORD via env. We strip the password from the URI
+// userinfo and set PGPASSWORD on the cmd.Env before exec — the password
+// no longer appears in cmdline.
+//
+// Conservative: if parsing fails, returns the original URL and "" — the
+// caller falls back to old behavior (no regression). Callers that want
+// hard-fail on parse can check the returned error.
+
+import (
+	"fmt"
+	"net/url"
+)
+
+// splitPGPassword returns the Postgres URL with the userinfo password
+// removed, plus the extracted password. If u has no password (e.g. SSL
+// cert auth) the returned password is "" and the URL is returned
+// unchanged. If u cannot be parsed as a URL, the input is returned
+// unchanged along with the parse error.
+//
+// Examples:
+//
+//	"postgres://u:p@h:5432/db?sslmode=require"
+//	  → ("postgres://u@h:5432/db?sslmode=require", "p", nil)
+//
+//	"postgres://u@h/db"        → ("postgres://u@h/db", "", nil)
+//	"postgres://h/db"          → ("postgres://h/db", "", nil)
+func splitPGPassword(rawURL string) (string, string, error) {
+	u, err := url.Parse(rawURL)
+	if err != nil {
+		return rawURL, "", fmt.Errorf("parse pg url: %w", err)
+	}
+	if u.User == nil {
+		return rawURL, "", nil
+	}
+	pw, hasPW := u.User.Password()
+	if !hasPW {
+		return rawURL, "", nil
+	}
+	// Reconstruct userinfo with only the username.
+	u.User = url.User(u.User.Username())
+	return u.String(), pw, nil
+}

internal/jobs/pgpw_test.go

@@ -0,0 +1,92 @@
+package jobs
+
+import (
+	"strings"
+	"testing"
+)
+
+// TestSplitPGPassword pins the SEC-WORKER FINDING-1 + FINDING-2 fix:
+// pg_dump call sites move the Postgres password from process argv into
+// PGPASSWORD env. The helper must:
+//   1. Strip the password from a typical userinfo URL.
+//   2. Pass through unchanged when there is no password (cert auth,
+//      no user, malformed URL with fail-open).
+//   3. Never leak the literal password in the returned URL.
+func TestSplitPGPassword(t *testing.T) {
+	cases := []struct {
+		name    string
+		in      string
+		wantURL string
+		wantPW  string
+		wantErr bool
+	}{
+		{
+			name:    "userpass",
+			in:      "postgres://doadmin:abc123@host:25060/db?sslmode=require",
+			wantURL: "postgres://doadmin@host:25060/db?sslmode=require",
+			wantPW:  "abc123",
+		},
+		{
+			name:    "user_only_no_password",
+			in:      "postgres://doadmin@host:25060/db?sslmode=require",
+			wantURL: "postgres://doadmin@host:25060/db?sslmode=require",
+			wantPW:  "",
+		},
+		{
+			name:    "no_userinfo",
+			in:      "postgres://host:25060/db",
+			wantURL: "postgres://host:25060/db",
+			wantPW:  "",
+		},
+		{
+			name:    "empty",
+			in:      "",
+			wantURL: "",
+			wantPW:  "",
+		},
+		{
+			name:    "percent_encoded_password",
+			in:      "postgres://u:p%40ss%40word@h:5432/db",
+			wantURL: "postgres://u@h:5432/db",
+			wantPW:  "p@ss@word", // url.Userinfo.Password() decodes
+		},
+		{
+			name:    "malformed_url_fail_open",
+			in:      "::::not a url",
+			wantURL: "::::not a url",
+			wantPW:  "",
+			wantErr: true,
+		},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			gotURL, gotPW, err := splitPGPassword(c.in)
+			if (err != nil) != c.wantErr {
+				t.Fatalf("err = %v, wantErr = %v", err, c.wantErr)
+			}
+			if gotURL != c.wantURL {
+				t.Errorf("URL\n  got:  %q\n  want: %q", gotURL, c.wantURL)
+			}
+			if gotPW != c.wantPW {
+				t.Errorf("password\n  got:  %q\n  want: %q", gotPW, c.wantPW)
+			}
+		})
+	}
+}
+
+// TestSplitPGPassword_NoLeak: the literal password substring must never
+// appear in the returned URL (this is THE point of the fix).
+func TestSplitPGPassword_NoLeak(t *testing.T) {
+	const secret = "ZZZ_NEVER_IN_URL_ZZZ"
+	in := "postgres://admin:" + secret + "@host:5432/db?sslmode=require"
+	gotURL, gotPW, err := splitPGPassword(in)
+	if err != nil {
+		t.Fatalf("splitPGPassword(%q) error: %v", in, err)
+	}
+	if strings.Contains(gotURL, secret) {
+		t.Errorf("returned URL %q still contains the password %q", gotURL, secret)
+	}
+	if gotPW != secret {
+		t.Errorf("password\n  got:  %q\n  want: %q", gotPW, secret)
+	}
+}

internal/jobs/platform_db_backup.go

@@ -623,18 +623,39 @@ func durationSeconds(d time.Duration) float64 {
 type defaultPgDumpExec struct{}
 
 // Dump runs pg_dump and streams its stdout to w.
+//
+// SEC-WORKER FINDING-1 (2026-05-29): the connection password is passed
+// to pg_dump out-of-band via PGPASSWORD env, NOT embedded in the URL on
+// argv. argv is world-readable via /proc/<pid>/cmdline for any sidecar /
+// debug shell / log-shipper / kube-exec process for the entire backup
+// window.
 func (defaultPgDumpExec) Dump(ctx context.Context, databaseURL string, w io.Writer) (int64, error) {
 	bin := os.Getenv("PG_DUMP_BIN")
 	if bin == "" {
 		bin = "pg_dump"
 	}
+	// Split password out of the URL → into PGPASSWORD env. If parse fails
+	// we fall back to the original URL (no regression): the same code path
+	// it has always run. The downside of fail-open is that a malformed
+	// URL would still leak; the alternative is hard-fail on every backup
+	// run because of one operator typo — caller chose the safer default.
+	dsn, pw, splitErr := splitPGPassword(databaseURL)
+	if splitErr != nil {
+		// non-fatal — fall back to original URL on argv
+		dsn = databaseURL
+		pw = ""
+	}
 	cmd := exec.CommandContext(ctx, bin,
 		"--no-owner",
 		"--no-acl",
 		"--format=custom",
 		"--compress=9",
-		databaseURL,
+		dsn,
 	)
+	if pw != "" {
+		// Inherit parent env so pg_dump still sees PATH, HOME, etc.
+		cmd.Env = append(os.Environ(), "PGPASSWORD="+pw)
+	}
 	// Capture stderr to a small buffer so a pg_dump failure produces a
 	// useful error message. stdout streams straight to w.
 	var stderr strings.Builder