Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

configuration should use environment variables rather than storing passwords in files

See original GitHub issue

Thanks for creating a cool way of visualising Discord traffic!

When checking this out to use on my own server I noticed a security issue – users must store their login details within a configuration file as indicated by the readme (1), and the configuration itself (2)

(1):

Rename discord-config-example.json to discord-config.json and insert the login and server info for your Discord server(s).

(2):

"email": "test@example.com",
"password": "password",

A better way of handling this is to have the user store their secrets as environment variables, and have the JSON structure indicate the names of the environment variables to use.

This eliminates the chance of a user accidentally (or purposefully) committing sensitive configuration details to the repo.

Issue Analytics

State:
Created 8 years ago
Comments:13 (8 by maintainers)

Top GitHub Comments

2reactions

vegeta897commented, May 30, 2018

I promise I will get around to this 😣

1reaction

SagnikPradhancommented, Apr 22, 2021

Seems like this can be closed.

OR. We could wait till I flesh out configuration validation.

Top Results From Across the Web

Is it secure to store passwords as environment variables ...

There's no way to store an un-encrypted password securely. Now which of environment variables vs. config files is more "secure" is perhaps debatable....

Keep your code secure by using environment variables and ...

The first reason is the most important by far: environment variables keep your credentials save. We want to prevent our code being riddled...

Analyzing the Hidden Danger of Environment Variables for ...

The use of environment variables is a common practice in the DevOps community as it provides easy access to configuration properties.

Storing credentials the right way! | by Abhishek Pathak - Medium

Environment variables (or env vars) are operating system level variables whose value can be used by one or more software programs, in our...

Is it safe to store critical passwords in server environment ...

A password should be put in a file that's aside from the configuration files that are under version control and from the normal...