benoitc / benoitc/erica

erica push insecurely echoes password to console

Open
#83 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
264
Forks
30
PR merge metrics
No merged PRs in 30d

Description

```
% erica push . default
==> couchapp (push)
==> Successfully pushed. You can browse it at: http://myuser:mypassword@127.0.0.1:5984/mydb/_design/myapp/_rewrite/
```

This is a shoulder-surfing risk. It would be better to strip at least the password from the URL.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by locating the code that handles the `erica push` command and prints the successful push URL. Trace how that URL is assembled, then verify the console output no longer exposes the password while retaining the usable destination URL.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
cli, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.