BuildForSDG / BuildForSDG/Cognito-App1-Complete
Important: Exposed MongoDB cluster in your code
- Dominant language
- JavaScript
- Stars
- 0
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Description
> [!WARNING]
> # You have an exposed mongoDB cluster containing multiple databases in this repository.
#### Hey BuildForSDG, If you receive this issue don't panic, I am a friendly automated script looking around the internet and just to let you know that you have an **exposed mongoDB cluster in your code**.
### I was able to connect and expose those databases from your cluster:
- CollHub
- astren
- authentication_app
- blog
- blog-2
- ecommerce
- google-oauth
- inventory_app
- khdemni
- local_library
- members_only
- noteit
- petconnect
- walidbook
- admin
- local
A **malicious attacker could leak data and get credentials** to your or people's services/system, even if you know that no sensible information is stored inside it, it is still very dangerous. I do not know what kind of information your databases hold but a malicious attacker could easily dump all the content, please **make sure to follow these steps**:
1. Put your secrets in a .env file
2. Use a library like [dotenv](https://www.npmjs.com/package/dotenv) to load the environment variables from your file onto your code
3. At this point, I would either suggest either using [github's tool ](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository) to erase the history or you could delete the repos on Github, remove the .git folder locally and recreate a new repos with a clean history
In the future make sure to **not expose your secrets** especially your mongodb uri as it contains your username and password combination. Make sure to **create a .env file and load your environment variables into your code accordingly**.
### If you like what I am doing for the community, please feel free to follow my github account @GaillardTom
Contributor guide
No contributing guide indexed for this repository
Research direction
Search the repository for the MongoDB URI and review how its credentials are currently stored. Read the linked GitHub guidance on removing sensitive data, then check the .env and dotenv recommendations in the issue. Done means the exposed secret is removed from the code and repository history, with access no longer publicly available.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, mongodb
- Domain
- databases, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100