4 ms·
Doesn't this defeat the whole purpose of the rfc? As I understand it, the rfc is meant to automatically detect commited secrets by basically finding the secret
by zufallsheld 6y ago
Doesn't this defeat the whole purpose of the rfc?
As I understand it, the rfc is meant to automatically detect commited secrets by basically finding the secret token uri. If one uses your library which automatically creates this uri by taking a secret and prepending "secret-token:" than the "secret token" part won't be part of the commited secret and thus not be detected by something that looks for the uri.
- lexicality 6y agoNo, this library is for either encoding secrets immediately after generating them, or decoding them in-memory should you need to do that. The main use case I created this library for is I look after a lot of 3rd party API keys and I want to encode all of them at rest using this RFC, but I'll need to decode them again in order to use them