security: Fix alembic.ini placeholder database URL

[YaronZaki]

Problem Statement

quantara/web_app/alembic.ini:53 contains sqlalchemy.url = driver://user:pass@localhost/dbname — a literal placeholder never configured for any environment. alembic/env.py does not read from environment variables to override this.

Evidence

# quantara/web_app/alembic.ini line 53
sqlalchemy.url = driver://user:pass@localhost/dbname

alembic/env.py has no os.getenv("DB_HOST") or similar override.

Impact

High — migration safety risk. If runtime override mechanism fails, Alembic tries connecting to localhost with user:pass — could corrupt a real database or fail silently in CI. Valid-looking URL is also a security scanner false-positive risk.

Proposed Solution

Update alembic/env.py to construct database URL from the same env vars used by database.py (DB_USER, DB_PASSWORD, DB_HOST, DB_PORT, DB_NAME). Set alembic.ini sqlalchemy.url to REPLACE_ME sentinel.

Acceptance Criteria

• alembic/env.py constructs DB URL from DB_USER, DB_PASSWORD, DB_HOST, DB_PORT, DB_NAME
• alembic.ini sqlalchemy.url set to REPLACE_ME (not a valid URL)
• Migration commands work in dev (docker exec backend_dev alembic upgrade head)
• Migration commands work in CI
• Missing env vars produce clear error message

File Map

• quantara/web_app/alembic.ini:53 — replace placeholder with REPLACE_ME
• quantara/web_app/alembic/env.py — add env-based URL construction

Testing Strategy

• Unit: Test URL construction with valid, partial, and missing env vars
• Integration: Run alembic upgrade head and alembic downgrade -1 in test database
• Manual: Unset DB_HOST, run alembic, verify clear error

Security Considerations

Fixes configuration weakness. Sentinel value (REPLACE_ME) ensures fail-fast: if env override doesn't run, Alembic immediately errors rather than silently connecting to localhost.

Definition of Done

• Code implemented and peer-reviewed
• Migrations tested in dev and CI
• Documentation updated if needed
• PR linked and merged

---

Labels: security, quick-win
Priority: High
Difficulty: Beginner
Estimated Effort: 0.5h

[demilade18-git]

can i take this on?

[grantfox-oss]

🦊 GrantFox — @demilade18-git has been assigned to this issue as part of the Official Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #44)
2. Your PR will be reviewed by the Quantarq maintainers

Good luck! Track your progress on GrantFox.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Official Campaign campaign!

@demilade18-git's PR #143 was approved and merged by @YaronZaki.

🏆 @demilade18-git: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (118 total points). Track your full progress on GrantFox.

👏 Great work, @demilade18-git! Keep contributing to Quantarq.