3 ms·
secrets don't belong in env vars, because many languages and/or frameworks will happily dump all your env vars to users in the event of misconfiguration or some
by fhgsfkcc 7y ago
secrets don't belong in env vars, because many languages and/or frameworks will happily dump all your env vars to users in the event of misconfiguration or some errors.
- paulddraper 7y agoI have literally never seen that happen. (Outside a core dump, which has a lot more than env var.) You have any examples in mind?
- ygjb 7y agoIt happens all the time, especially in security and quality assurance testing. It's less common in modern versions of tools and frameworks, but I routinely encounter these kinds of dumps when I am doing security testing work on anything enterprisey.
- nikisweeting 7y agoDjango error pages with DEBUG=True.