Protect passwords and secrets.
- Lingua principale
- Go
- Stelle
- 1.2k
- Fork
- 69
- Metriche di merge delle PR
- Nessuna PR unita negli ultimi 30g
Descrizione
**Is your feature request related to a problem? Please describe.**
When adding secrets and or password to notifiers they should not be visible again.
**Describe the solution you'd like**
When modifying a notifier require secrets to be resubmitted. For a simple monitoring service some people will use weaker passwords which are more likely to be compromised. There are different levels of concern.
For example:
level 0: I don't care if someone gets access to a service that is simply monitoring my servers.
level 1: Someone gets access and can add monitors / notifiers. More concerning but not would ending.
level 2: Someone gets access and can see credentials to my notifiers which will give them the ability to use any of those services, one worse case is email. Depending on the setup could lead to more compromises.
Then there are multi-user concerns as well. I'm just starting to look at this project, I don't think multi-user has been added yet but this also reduces risk there as well. Even if a user has permission to modify the notifiers they would still need to provide the notifier's credentials.
Guida per i contributori
Nessuna guida per i contributori indicizzata per questo repository
Direzione di ricerca
Look at the notifier configuration code, likely in a directory like `notifiers/` or `internal/notifier/`. Identify where secrets (passwords, API keys) are currently stored and displayed. The change requires modifying the update flow to mask or require re-entry of secrets, and possibly adding a field to track if a secret is set. Check existing tests for notifiers to understand the current behavior and add tests for the new security requirement.
Scritto dal modello di indicizzazione a partire dal testo della issue.
Valutazione
- Stack tecnologico
- go
- Ambito
- security
- Tipo di issue
- Funzionalità
- Difficoltà
- 4/5
- Tempo stimato
- 3-5 giorni
- Stato di attività
- Ferma
- Chiarezza
- Abbastanza chiara
- Idoneità per principianti
- 40/100