fix(examples): require environment variable for shared secret to prevent hardcoded credentials - #67
Open
magqqgq wants to merge 1 commit into
Open
fix(examples): require environment variable for shared secret to prevent hardcoded credentials#67magqqgq wants to merge 1 commit into
magqqgq wants to merge 1 commit into
Conversation
…ent hardcoded credentials ### Description This PR addresses a high-severity secrets and configuration management vulnerability within the `examples` repository[cite: 30]. It removes a hardcoded shared secret from the message encryption example to prevent the unnecessary disclosure and accidental reuse of sensitive cryptographic material[cite: 30]. ### Key Changes * **Secrets Management (`examples/identity/messages-shared-secret/index.js`):** - Replaced the previously committed static shared secret with a runtime environment variable lookup (`process.env.DESO_SHARED_SECRET`)[cite: 30, 40]. - Implemented a fail-fast validation check that explicitly throws an error (`"Set DESO_SHARED_SECRET before running this example."`) if the developer attempts to execute the script without providing the necessary environment variable[cite: 40]. ### Validation & Testing * **Static Verification:** JavaScript syntax validation (`node --check`) passed successfully for the modified example file, confirming the code parses correctly without execution[cite: 30]. * **Reviewer Action Required:** Any historically exposed shared secrets within the Git repository history should be considered compromised and must be rotated by their owner[cite: 30]. Developers utilizing this example must now securely supply a valid `DESO_SHARED_SECRET` in their local environment prior to execution[cite: 40].
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR addresses a high-severity secrets and configuration management vulnerability within the
examplesrepository[cite: 30]. It removes a hardcoded shared secret from the message encryption example to prevent the unnecessary disclosure and accidental reuse of sensitive cryptographic material[cite: 30].Key Changes
examples/identity/messages-shared-secret/index.js):process.env.DESO_SHARED_SECRET)[cite: 30, 40]."Set DESO_SHARED_SECRET before running this example.") if the developer attempts to execute the script without providing the necessary environment variable[cite: 40].Validation & Testing
node --check) passed successfully for the modified example file, confirming the code parses correctly without execution[cite: 30].DESO_SHARED_SECRETin their local environment prior to execution[cite: 40].