achintya-7 / achintya-7/go-socketio

Important: Exposed MongoDB cluster in your code

オープン
#2 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る
主要言語
Go
スター
2
フォーク
0
PR マージ指標
30日以内にマージされた PR はありません

説明

> [!WARNING]
> # You have an exposed mongoDB cluster containing multiple databases in this repository.
#### Hey achintya-7, If you receive this issue don't panic, I am a friendly automated script looking around the internet and just to let you know that you have an **exposed mongoDB cluster in your code** that I got from this file https://github.com/achintya-7/go-socketio/blob/a77a44c3b9c9d4d53c1ae2a2dc16266e807dd147/controllers/controller.go.

### I was able to connect and expose those databases from your cluster:
- schzoom
- users
- admin
- local

**From these possible clusters: cluster0.wuvef.mongodb.net**

A **malicious attacker could leak data and get credentials** to your or people's services/system, even if you know that no sensible information is stored inside it, it is still very dangerous. I do not know what kind of information your databases hold but a malicious attacker could easily dump all the content, please **make sure to follow these steps**:

1. Put your secrets in a .env file
2. Use a library like [dotenv](https://www.npmjs.com/package/dotenv) to load the environment variables from your file onto your code
3. At this point, I would either suggest either using [github's tool ](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository) to erase the history or you could delete the repos on Github, remove the .git folder locally and recreate a new repos with a clean history

In the future make sure to **not expose your secrets** especially your mongodb uri as it contains your username and password combination. Make sure to **create a .env file and load your environment variables into your code accordingly**.

### If you like what I am doing for the community, please feel free to follow my github account @GaillardTom

コントリビューションガイド

このリポジトリのコントリビューションガイドは索引されていません

評価

この issue はまだ評価されていません。

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。