search

risoflora / wethr

🌤️ Command line weather tool.
MIT License
54 stars 3 forks source link

[SECURITY] API token is published #5

Closed jhpratt closed 3 years ago

jhpratt commented 3 years ago

API tokens should never be committed. They should be stored in environment variables or a configuration file that is in .gitignore.

silvioprog commented 3 years ago

@jhpratt hmm, do you mean src/consts.rs#L5? If so, it is public: twobucks/wethr/wethr.js#L7.

jhpratt commented 3 years ago

Yes, that is what I was referring to. Seems odd that they would have a public API key, but okay 🙂 It's their problem, not yours.

silvioprog commented 3 years ago

Anyway, it should be configured too, assuming this default one if not informed. I'm going to add it to the wish list. Thanks for reporting! :smiley:

silvioprog commented 3 years ago

@jhpratt done: #wish-list :+1: