Closed evilpacket closed 5 years ago
I think we need clarification here. I don't disagree with these, but we need to ensure that we do not couple package managers with the repositories responsibility to identify sensitive things. Most repos have APIs which are used to publish packages. Maven, NuGet, Pypi, etc, either dont have the ability to publish packages, or have the ability but also offer additional means (manual upload in web ui, rest api, etc).
I agree this is not easy, but I think it is worth tracking. I'm adding it. Thanks!
Sensitive data can be leaked during the publication process of a package. While it's not possible for a package manager to know what is sensitive at all times at a minimum I think package managers should be prepared to protect against their own users authentication credentials / tokens from being leaked and automatically revoke them.
I propose
Prevents credential from being published
The package manager provides some control to prevent the authentication credentials / token / session from being leaked as part of the package contents.