code4romania/covid-19-jurnal-medical

Credentials are stored on GIT repository

Open

#438 opened on May 25, 2020

View on GitHubContributor guide
 (2 comments) (0 reactions) (0 assignees)C# (50 forks)auto 404
apibughelp wanted

Repository metrics

Stars
 (14 stars)
PR merge metrics
 (No merged PRs in 30d)

Description

An attacker or a malicious administrative user with access to the GIT platform or the GIT repository can obtain or create a public leak of a wide range of credentials and other API keys in order to create disturbances, escalate privileges or use the obtained information in other attacks.

Do not store credentials, API keys or configuration files in GIT. The most you can do is place a dummy configuration file that will be edited prior to any deployment on the system environment.

Contributor guide

Research direction
Search the repository for files containing credentials or API keys. Use 'git log all p' to check historical commits for leaked secrets. Remove the files and add patterns to .gitignore.
Tech stack
csharp
Domain
backend
Issue type
Security
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
Git
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
75