search

nk-gears / personal-automation-scripts

All personal automation scripts
0 stars 0 forks source link

Your macrodroid webhook is exposed #1

Open burchill opened 4 years ago

burchill commented 4 years ago

Hi, I have no idea who you are, but I just wanted to inform you that you have your Macrodroid webhook (in battery-alert.sh) exposed and searchable on GitHub. It's honestly probably not anything too important either way, but especially if you have your phone doing something relatively important in response to that hook, you might want to move the url to a non-tracked file, and have Python read the string and then make the request using that value. Or, perhaps even more simply, you could just generate a tinyurl for it, and use that. Right now I could, for example, spam whatever it is that webhook is supposed to trigger, since (to my best knowledge), Macrodroid webhooks don't try to authenticate for anything.

I only noticed this because I decided to just search "trigger.macrodroid.com" on GitHub on a whim and found your repo. If I thought of something like this, I bet there are a bunch of trolls out there who could think of the same thing and would act maliciously.

Just giving you a heads up!

nk-gears commented 4 years ago

HI Burchill, Thanks for the feedback.

I have noted. Appreciated for taking time to report this.