3 ms·
How does this prevent them from stealing the '.env.enc' file and the password for it? So instead of simply stealing process.env. They have to do a search for r
by compressedgas 7y ago
How does this prevent them from stealing the '.env.enc' file and the password for it?
So instead of simply stealing process.env. They have to do a search for require('secure-env') and find the secret. And then they just upload that secret and the .env.enc file.
- kunalpanchal 7y agoThe file .env.enc can be renamed to anything more clever as per your requirement. Also the password you pass in to require('secure-env') can be obtained from printenv. You set this on your server, similar to a master password. So it's not there in your code.