0xfurai / 0xfurai/peekaping

Protect passwords and secrets.

Aperta
#257 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub
Lingua principale
Go
Stelle
1.2k
Fork
69
Metriche di merge delle PR
Nessuna PR unita negli ultimi 30g

Descrizione

**Is your feature request related to a problem? Please describe.**
When adding secrets and or password to notifiers they should not be visible again.

**Describe the solution you'd like**
When modifying a notifier require secrets to be resubmitted. For a simple monitoring service some people will use weaker passwords which are more likely to be compromised. There are different levels of concern.
For example:
level 0: I don't care if someone gets access to a service that is simply monitoring my servers.
level 1: Someone gets access and can add monitors / notifiers. More concerning but not would ending.
level 2: Someone gets access and can see credentials to my notifiers which will give them the ability to use any of those services, one worse case is email. Depending on the setup could lead to more compromises.

Then there are multi-user concerns as well. I'm just starting to look at this project, I don't think multi-user has been added yet but this also reduces risk there as well. Even if a user has permission to modify the notifiers they would still need to provide the notifier's credentials.

Guida per i contributori

Nessuna guida per i contributori indicizzata per questo repository

Direzione di ricerca

Look at the notifier configuration code, likely in a directory like `notifiers/` or `internal/notifier/`. Identify where secrets (passwords, API keys) are currently stored and displayed. The change requires modifying the update flow to mask or require re-entry of secrets, and possibly adding a field to track if a secret is set. Check existing tests for notifiers to understand the current behavior and add tests for the new security requirement.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Valutazione

Stack tecnologico
go
Ambito
security
Tipo di issue
Funzionalità
Difficoltà
4/5
Tempo stimato
3-5 giorni
Stato di attività
Ferma
Chiarezza
Abbastanza chiara
Idoneità per principianti
40/100

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.