BuildForSDG / BuildForSDG/Cognito-App1-Complete

Important: Exposed MongoDB cluster in your code

Open
#18 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
0
Forks
0
PR merge metrics
No merged PRs in 30d

Description

> [!WARNING]
> # You have an exposed mongoDB cluster containing multiple databases in this repository.
#### Hey BuildForSDG, If you receive this issue don't panic, I am a friendly automated script looking around the internet and just to let you know that you have an **exposed mongoDB cluster in your code**.

### I was able to connect and expose those databases from your cluster:
- CollHub
- astren
- authentication_app
- blog
- blog-2
- ecommerce
- google-oauth
- inventory_app
- khdemni
- local_library
- members_only
- noteit
- petconnect
- walidbook
- admin
- local

A **malicious attacker could leak data and get credentials** to your or people's services/system, even if you know that no sensible information is stored inside it, it is still very dangerous. I do not know what kind of information your databases hold but a malicious attacker could easily dump all the content, please **make sure to follow these steps**:

1. Put your secrets in a .env file
2. Use a library like [dotenv](https://www.npmjs.com/package/dotenv) to load the environment variables from your file onto your code
3. At this point, I would either suggest either using [github's tool ](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository) to erase the history or you could delete the repos on Github, remove the .git folder locally and recreate a new repos with a clean history

In the future make sure to **not expose your secrets** especially your mongodb uri as it contains your username and password combination. Make sure to **create a .env file and load your environment variables into your code accordingly**.

### If you like what I am doing for the community, please feel free to follow my github account @GaillardTom

Contributor guide

No contributing guide indexed for this repository

Research direction

Search the repository for the MongoDB URI and review how its credentials are currently stored. Read the linked GitHub guidance on removing sensitive data, then check the .env and dotenv recommendations in the issue. Done means the exposed secret is removed from the code and repository history, with access no longer publicly available.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, mongodb
Domain
databases, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.