elegantframework / elegantframework/elegantframework.com
Secrets are leaking in the browser
- Dominant language
- TypeScript
- Stars
- 8
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Description
I posted about this in all your forums including the discord and got no response
github: https://github.com/orgs/elegantframework/discussions/567
reddit: https://www.reddit.com/r/elegantframework/comments/1fzbfpp/github_secret_and_token_secret_should_be_public/
So i decided to investigate myself and looked at demo.myelegant.app and i can see the github oauth secrets in public view.
This should obviously be hidden and not exposed to the front end given even github doesnt let you see it more than one time
Unless im wrong and i dont understand how this is ok, please let me know.
Attached screenshot of the secrets (obscured) in the browser

Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.