Scan deployments for deploy keys/passwords

clojars / clojars-web

A community repository for open-source Clojure libraries

https://clojars.org

Eclipse Public License 1.0

470 stars 114 forks source link

Open tobias opened 4 years ago

tobias commented 4 years ago

project.clj files are included in deployment jars, and sometimes people put the clojars password/token in the project.clj. We should:

add a validation that rejects deployments that contain a credential in project.clj
scan all existing artifacts for any current passwords/tokens and disable the password/token, emailing the user