OpenFn / OpenFn/lightning

security: .env.example contains real RSA private key and worker secret as example values

Open
#4,706 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Elixir
Stars
296
Forks
86
Avg merge
1d 13h
Merged PRs (30d)
50

Description

Description

The .env.example file contains what appears to be a real RSA private key
and worker secret used as example values rather than placeholder strings.

Specifically:

  • Line with WORKER_RUNS_PRIVATE_KEY contains a base64-encoded value that
    decodes to a valid -----BEGIN RSA PRIVATE KEY----- block
  • Line with WORKER_SECRET contains a real 256-bit secret value

Risk

Any operator who copies these values directly into their production .env
without generating new keys will be running with publicly known credentials.
An attacker with access to this repo can use these keys to authenticate as
a worker to any Lightning instance using the example values.

Suggested Fix

Replace the real key material with generation instructions:

# WORKER_RUNS_PRIVATE_KEY="generate with: mix lightning.gen_worker_keys"
# WORKER_SECRET="generate with: mix lightning.gen_worker_keys"

The DEPLOYMENT.md already documents mix lightning.gen_worker_keys
pointing to it from the .env.example is safer than providing real keys.

Steps to Verify

echo "LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQ..." | base64 -d
# Returns a valid RSA private key

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Inspect the credential entries in .env.example, then read DEPLOYMENT.md for the documented mix lightning.gen_worker_keys command. Replace the exposed example values with generation guidance that points to that command, and verify that the example contains no usable key or secret.

Written by the indexing model from the issue text.

Assessment

Tech stack
elixir
Domain
devops, security
Issue type
Bug
Difficulty
1/5
Estimated time
Under an hour
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.