{"action":"created","issue":{"url":"https://api.github.com/repos/NARKOZ/hacker-scripts/issues/42","labels_url":"https://api.github.com/repos/NARKOZ/hacker-scripts/issues/42/labels{/name}","comments_url":"https://api.github.com/repos/NARKOZ/hacker-scripts/issues/42/comments","events_url":"https://api.github.com/repos/NARKOZ/hacker-scripts/issues/42/events","html_url":"https://github.com/NARKOZ/hacker-scripts/issues/42","id":119029193,"number":42,"title":"Password in Source Code","user":{"login":"gszathmari","id":4806014,"avatar_url":"https://avatars.githubusercontent.com/u/4806014?v=3","gravatar_id":"","url":"https://api.github.com/users/gszathmari","html_url":"https://github.com/gszathmari","followers_url":"https://api.github.com/users/gszathmari/followers","following_url":"https://api.github.com/users/gszathmari/following{/other_user}","gists_url":"https://api.github.com/users/gszathmari/gists{/gist_id}","starred_url":"https://api.github.com/users/gszathmari/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gszathmari/subscriptions","organizations_url":"https://api.github.com/users/gszathmari/orgs","repos_url":"https://api.github.com/users/gszathmari/repos","events_url":"https://api.github.com/users/gszathmari/events{/privacy}","received_events_url":"https://api.github.com/users/gszathmari/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-11-26T11:44:09Z","updated_at":"2015-11-26T12:02:21Z","closed_at":null,"body":"The password for the coffee machine is stored in the source code, which is `1234`:\r\nhttps://github.com/NARKOZ/hacker-scripts/blob/master/fucking_coffee.rb#L12\r\n\r\nThis could allow anyone with access to the source code to access the coffee machine on the network.\r\n\r\nPlease remove the password from the source code into an environmental variable, and rotate the credentials on the coffee machine immediately."},"comment":{"url":"https://api.github.com/repos/NARKOZ/hacker-scripts/issues/comments/159896075","html_url":"https://github.com/NARKOZ/hacker-scripts/issues/42#issuecomment-159896075","issue_url":"https://api.github.com/repos/NARKOZ/hacker-scripts/issues/42","id":159896075,"user":{"login":"gszathmari","id":4806014,"avatar_url":"https://avatars.githubusercontent.com/u/4806014?v=3","gravatar_id":"","url":"https://api.github.com/users/gszathmari","html_url":"https://github.com/gszathmari","followers_url":"https://api.github.com/users/gszathmari/followers","following_url":"https://api.github.com/users/gszathmari/following{/other_user}","gists_url":"https://api.github.com/users/gszathmari/gists{/gist_id}","starred_url":"https://api.github.com/users/gszathmari/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gszathmari/subscriptions","organizations_url":"https://api.github.com/users/gszathmari/orgs","repos_url":"https://api.github.com/users/gszathmari/repos","events_url":"https://api.github.com/users/gszathmari/events{/privacy}","received_events_url":"https://api.github.com/users/gszathmari/received_events","type":"User","site_admin":false},"created_at":"2015-11-26T12:02:21Z","updated_at":"2015-11-26T12:02:21Z","body":"How about if we switch to a microservices architecture and store the password in a config service instead?\n\n\n> On 26 Nov 2015, at 12:00, P B Surya Subhash <notifications@github.com> wrote:\n> \n> Hey, \n> Just replace the password with an environment placeholder for the production workspace and mention in the README to update the placeholder with the password. In this way hardcoding the passwords can be avoided. \n> Alternatively, encrypting the text is another option. However, this can be dangerous if a weak encryption is being used.\n> \n> Reach out to me if you'd like to know more about this issue :) I'd be happy to help.\n> \n> Best.\n> \n> —\n> Reply to this email directly or view it on GitHub <https://github.com/NARKOZ/hacker-scripts/issues/42#issuecomment-159895256>.\n> \n\n"}}