elegantframework / elegantframework/elegantframework.com

Secrets are leaking in the browser

Open
#30 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
8
Forks
0
PR merge metrics
No merged PRs in 30d

Description

I posted about this in all your forums including the discord and got no response

github: https://github.com/orgs/elegantframework/discussions/567
reddit: https://www.reddit.com/r/elegantframework/comments/1fzbfpp/github_secret_and_token_secret_should_be_public/

So i decided to investigate myself and looked at demo.myelegant.app and i can see the github oauth secrets in public view.

This should obviously be hidden and not exposed to the front end given even github doesnt let you see it more than one time

Unless im wrong and i dont understand how this is ok, please let me know.

Attached screenshot of the secrets (obscured) in the browser

![Screenshot 2024-10-09 at 1 00 59 PM](https://github.com/user-attachments/assets/3a2f8b99-f0d5-4832-b1c7-d4e718399a36)

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.