search

foltz / powerpost-boilerplate

0 stars 0 forks source link

Urgent security warning #1

Open dsernst opened 7 years ago

dsernst commented 7 years ago

@foltz:

This is a friendly warning about your PR to chateau: https://github.com/neumino/chateau/pull/64:

You committed and published in your personal connection secrets. This is a major security hole. They are now publicly known. Best to reset ASAP!

Possible consequences:

An attacker exploits these, stealing your data, holding it for ransom, or deleting it. Or could run up Compose fees for other things.

I wanted to contact you privately to warn you, but couldn't find contact info on your profile. Thought it would be better to warn you in this separate repo, where there are less Watchers than https://github.com/neumino/chateau/pull/64.

foltz commented 7 years ago

doh! thanks for the heads up. just updated the file, then closed the PR since it looks like someone else has submitted another PR with the same updates - although guessing that someone could still find the key if they go back through the history, so I'll reset the API key for our connection.

thanks again.

On Sun, May 21, 2017 at 6:46 PM, David Ernst notifications@github.com wrote:

@foltz https://github.com/foltz: This is a friendly warning about your PR to chateau: neumino/chateau#64 https://github.com/neumino/chateau/pull/64:

You committed and published in your personal connection secrets. This is a major security hole. They are now publicly known. Best to reset ASAP! Possible consequences:

An attacker exploits these, stealing your data, holding it for ransom, or deleting it. Or could run up Compose fees for other things.

I wanted to contact you privately to warn you, but couldn't find contact info on your profile. Thought it would be better to warn you in this separate repo, where there are less Watchers than neumino/chateau#64 https://github.com/neumino/chateau/pull/64.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/foltz/powerpost-boilerplate/issues/1, or mute the thread https://github.com/notifications/unsubscribe-auth/AAWqT9ipwD7AOiaAT6lYfU9iljTgtTlGks5r8MzRgaJpZM4Nhw3a .

dsernst commented 7 years ago

:smile: