Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: I built an open source event-management system

github.com

Post reply on HN
Print view View original

1–10 of 32 posts

Re: Show HN: I built an open source event-management system

#2

Post by graystevens »

Looks like you committed a .env file previously with some semi-private details contained within it, plus you’ve hardcoded some Cloudinary API credentials. You may want to rotate them before they’re abused by someone.

Edit: oh and some database credentials & getstream.io api credentials

Re: Show HN: I built an open source event-management system

#3

Post by rsyring »

graystevens wrote: post #2

Looks like you committed a .env file previously with some semi-private details contained within it, plus you’ve hardcoded some Cloudinary API credentials. You may want to rotate them before they’re abused by someone. Edit: oh and some database credentials & getstream.io api credentials

If anyone wants to keep secrets in a repo, git-crypt is your friend:

https://www.agwa.name/projects/git-crypt/

Re: Show HN: I built an open source event-management system

#4

Post by iyanuashiri »

graystevens wrote: post #2

Looks like you committed a .env file previously with some semi-private details contained within it, plus you’ve hardcoded some Cloudinary API credentials. You may want to rotate them before they’re abused by someone. Edit: oh and some database credentials & getstream.io api credentials

Thank you for this. I will do that ASAP

Re: Show HN: I built an open source event-management system

#5

Post by iyanuashiri »

rsyring wrote: post #3
graystevens wrote: post #2

Looks like you committed a .env file previously with some semi-private details contained within it, plus you’ve hardcoded some Cloudinary API credentials. You may want to rotate them before they’re abused by someone. Edit: oh and some database credentials & getstream.io api credentials

If anyone wants to keep secrets in a repo, git-crypt is your friend: https://www.agwa.name/projects/git-crypt/

Thanks. Checking it out

Re: Show HN: I built an open source event-management system

#6

Post by Selfcommit »

rsyring wrote: post #3
graystevens wrote: post #2

Looks like you committed a .env file previously with some semi-private details contained within it, plus you’ve hardcoded some Cloudinary API credentials. You may want to rotate them before they’re abused by someone. Edit: oh and some database credentials & getstream.io api credentials

If anyone wants to keep secrets in a repo, git-crypt is your friend: https://www.agwa.name/projects/git-crypt/

BlackBox is also great for this purpose:

https://github.com/StackExchange/blackbox

Re: Show HN: I built an open source event-management system

#8

Post by solox3 »

iyanuashiri wrote: post #5
rsyring wrote: post #3

Earlier quoted context omitted.

If anyone wants to keep secrets in a repo, git-crypt is your friend: https://www.agwa.name/projects/git-crypt/

Thanks. Checking it out

Old commits are still showing the credentials. Recommend following this guide to erase your .env from all commits.

https://help.github.com/articles/removing-sensitive-data-fro...

Re: Show HN: I built an open source event-management system

#9

Post by krageon »

solox3 wrote: post #8
iyanuashiri wrote: post #5

Earlier quoted context omitted.

Thanks. Checking it out

Old commits are still showing the credentials. Recommend following this guide to erase your .env from all commits. https://help.github.com/articles/removing-sensitive-data-fro...

It's too late now in any case. Removing them is cute, but in terms of security credentials can only be rotated now. Removing them doesn't help when someone has already pulled that history previously.
Post reply on HN