AbRahman-ra / zatca-api-guideline

5 stars 2 forks source link

Private keys exposed ? #1

Closed AYehia0 closed 7 months ago

AYehia0 commented 7 months ago

are you just exposed the private keys in privkey.pem ? And other credentials ?

I am no expert in this but I have seen some private keys !

Close this issue if I am mistaken :D

AbRahman-ra commented 7 months ago

Hello Yehia 👋, Thanks for pointing this out.

It is never an issue, I uploaded them on purpose for sampling. If you reviewed the sample testing code in the requests.php file, you will observe that a new private key will be generated on every run for the script. Thus, this key will change every time you php requests.php.

Moreover, the targetted endpoint is a testing environment, not a production one, even the data inside the cnf file is a dummy data.

In addition, the script is a general open-source snippet that's designed to be injected into your code with template data.

The attached screenshot is for a friend asking your question this morning.

Finally, keep in mind that we will generate the keys on production only in the first time.

Enjoy your key 😃.

Screenshot_20240215_001109_WhatsApp.png

AYehia0 commented 7 months ago

Thanks, @AbRahman-ra for clarifying out. Well, I am no PHP expert, but I noticed it, so I wanted to say Hello :D Have a good day D: