4 ms·
How are they getting access to the PostgreSQL database, unless this running code can communicate with it? That’s a big red flag, user provided code should alway
by nodesocket 1y ago
How are they getting access to the PostgreSQL database, unless this running code can communicate with it? That’s a big red flag, user provided code should always be sandboxed and isolated right?
- megamorf 1y agoThe exfiltrated environment variables contained these entries: ``` "POSTGRESQL_DATABASE": "(CENSORED)", "POSTGRESQL_HOST": "(CENSORED)", "POSTGRESQL_PASSWORD": "(CENSORED)", "POSTGRESQL_USER": "(CENSORED)", ```
- nodesocket 1y agoSure, but connections from these worker machines shouldn’t be allowed directly to the database.