scripting / feedToMasto

Node app that checks a list of feeds periodically, post new items to Mastodon.
MIT License
26 stars 0 forks source link

Use the app on Glitch.com, needs better security #3

Open frankmeeuwsen opened 1 year ago

frankmeeuwsen commented 1 year ago

I imported the app from Github to Glitch.com and started a simple Node-app on their service. I needed to update the package.json with some extra info to start the app

"scripts": { "start": "node feedtomasto.js" }

After that, it all worked pretty well.

But I archived the FeedToMasto app on glitch.com since I found out my clientkey/secret and accesstoken were publicly accessible from the sourcecode. Without even opening an account on Glitch. That's a pretty big security issue. I removed the tokens from my account settings here as well. I would like to find out how to use an .env file in the config.json file on Glitch.com. This makes it easier to use, link to and remix on glitch.com. It's something I need to find out on Glitch.com, but I thought it's good to share over here, to be aware of potential security issues by just pasting in developer tokens in scripts :-)