CRITICAL SECURITY ISSUE - IMPLEMENT SECRET MANAGMENT AND FIX OLD API KEYS.

COSC481W-2024Winter / JARVIS

J.A.R.V.I.S

2 stars 3 forks source link

CRITICAL SECURITY ISSUE - IMPLEMENT SECRET MANAGMENT AND FIX OLD API KEYS. #17

Closed ghost closed 9 months ago

ghost commented 9 months ago

We have accidentally included API keys in our JARVIS code. We must revoke these API keys. If we have any previous projects (In the course of working on JARVIS tech stack) which have API keys, we should also revoke those.
We must implement a secrets management system and a method for auditing our secrets management.
We must have a SOP for if one accidentally includes keys.

Since this is a critical security issue, it will be placed at the top of our Sprint Backlog to be completed ASAP.

ghost commented 9 months ago

Here is our list of priorities

[x] Draft SOP [02/11/24]
[x] Educate all team members on secret management and SOP. [02/11/24]
[x] Revoke keys Dayshia [02/11/24]
[x] Revoke keys HaoHua [02/11/24]
[x] Revoke keys Luna [02/11/24]
[x] Revoke keys Emily [02/11/24]
[x] Revoke keys Tyler [02/11/24]
[x] Revoke keys Jacob [02/11/24]
[x] Implement .env variables [02/12/24]

The security information will be contained in the SOP guide, and not on github.

ghost commented 9 months ago

The branch name has changed it is this branch emarron/implement-secret-managment-and-fix-old-api-keys. It does not seem to update on the right.

ghost commented 9 months ago

@haohuazheng3 has implemented his own version of this, We can mark this PBI as closed. The branch has now been deleted. I did show Dr. Jiang the progress on this branch.