3 ms·
> The tenantConfig however can be accessed without any restrictions. And the information delivered there is quite interesting: API keys and URLs for various ser
by rad_gruchalski 5y ago
> The tenantConfig however can be accessed without any restrictions. And the information delivered there is quite interesting: API keys and URLs for various services that are apparently used by the Gorillas/eddress infrastructure. Among them we found API keys for Sendgrid and Slack webhook URLs.
Unreal.
- Nextgrid 5y agoI can't think of any legitimate purpose for an endpoint to expose its secrets, even if behind authentication.
- edoceo 5y agoDebugging? Like when you litter your code with printf (or console.log or whatever is cool today). Move fast, break things, ignore gdb
- gtf21 5y agoI suspect that they thought this was a clever way of allowing tenant applications to host their own configuration somewhere which the application would fetch and use. It's a whitelabelled application by the sounds of it. Pretty shocking but I can't think of any other line of reasoning.