search

seth-institute / project

Project Tracking and Documentation
0 stars 0 forks source link

Remove and refresh Google service account credentials #13

Open silvestry opened 4 years ago

silvestry commented 4 years ago

Email per Googe: Potentially compromised credentials for Google Cloud Platform/API project seth-... Dear Customer, We have detected potentially compromised Service Account authentication credentials associated with the following Google Cloud Platform account(s): seth-... with key ID ...

This key was found at the following URL: https://github.com/seth-institute/wix-app/blob/b97b8182c2bf6da0b05694dff24aeb965f123524/src/backend/drive_credentials.js

Based on our investigation of the issue, we believe that you or your organization may have inadvertently published the affected Service Account credentials in public sources or websites (for instance, if credentials were mistakenly uploaded to a service like GitHub). Please note that as the project/account owner, you are responsible for securing your resources.

Immediate action is required to secure your account(s). We strongly recommend that you take the following steps:

Log in to the Google Cloud Console and review the activity on your account. Revoke all (or listed) credentials for compromised Service Accounts. As every resource accessible to the Service Account may have been affected, it is best to rotate all credentials on potentially affected projects. For more details, review the instructions available here. Delete all unauthorized VMs or resources if you see any. Take immediate steps to ensure that your Service Account credentials are not embedded in public source code systems, stored in download directories, or unintentionally shared in other ways. The security of your Google Cloud Platform account(s) is important to us. You can find more information on securely using IAM here and also recommend best practices for keeping service accounts keys safe.

silvestry commented 4 years ago

Removed credentials from repo, removed existing key, and added new key to app manually. Need to find way to auto import credentials on import instead.