3 ms·
This doesn’t really fix that it can echo the secrets and read the logs. `enveil run — printenv`
by hjkl_hacker 7mo ago
This doesn’t really fix that it can echo the secrets and read the logs. `enveil run — printenv`
- Datagenerator 7mo agoNot the author but No, the decryption would ask the secret again? The readme mentions it's wiped from memory after use.
- darthwalsh 7mo agoJenkins CI has a clever feature where every password it injects will be redacted if printed to stdout; `enveil run` could do that with the wrapped process? Of course that's only a defense against accidents. Nothing prevents encoding base64 or piping to disk.