security: .env.example contains real RSA private key and worker secret as example values
Nobody has claimed this yet.
- Dominant language
- Elixir
- Stars
- 296
- Forks
- 86
- Avg merge
- 1d 13h
- Merged PRs (30d)
- 50
Description
Description
The .env.example file contains what appears to be a real RSA private key
and worker secret used as example values rather than placeholder strings.
Specifically:
- Line with
WORKER_RUNS_PRIVATE_KEYcontains a base64-encoded value that
decodes to a valid-----BEGIN RSA PRIVATE KEY-----block - Line with
WORKER_SECRETcontains a real 256-bit secret value
Risk
Any operator who copies these values directly into their production .env
without generating new keys will be running with publicly known credentials.
An attacker with access to this repo can use these keys to authenticate as
a worker to any Lightning instance using the example values.
Suggested Fix
Replace the real key material with generation instructions:
# WORKER_RUNS_PRIVATE_KEY="generate with: mix lightning.gen_worker_keys"
# WORKER_SECRET="generate with: mix lightning.gen_worker_keys"
The DEPLOYMENT.md already documents mix lightning.gen_worker_keys —
pointing to it from the .env.example is safer than providing real keys.
Steps to Verify
echo "LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQ..." | base64 -d
# Returns a valid RSA private key
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Inspect the credential entries in .env.example, then read DEPLOYMENT.md for the documented mix lightning.gen_worker_keys command. Replace the exposed example values with generation guidance that points to that command, and verify that the example contains no usable key or secret.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- elixir
- Domain
- devops, security
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 55/100