Storage of token secret in cleartext
Open
enhancement
- Dominant language
- TypeScript
- Stars
- 1
- Forks
- 0
- PR merge metrics
- PR metrics pending
Description
https://github.com/FNNDSC/cumin/blob/22a83fabba4673e6abedf80f43e629ce44a644a8/src/config/config.ts#L80-L81
Secrets should not be written in cleartext to files. Popular alternative solutions include:
- Obfuscation (e.g. `docker login`, `podman login`, popular pick is to use base64 encoding). Bad but better than nothing.
- System keyring (e.g. https://pypi.org/project/keyring/), usually works ok, in some cases decoupled integration with password managers is achieved
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.