3 ms·

So what stops it from sending a network request to a git repo that pushes what that placeholder resolves to?

• skinfaxi 2mo ago
  How would that work? You don't control github.com servers so your repo would never see the secret. edit: You may want to look into tokenizing proxies as the general application of this concept.
  • llimllib 2mo ago
    Your agent writes secret.txt with the placeholder, and the tokenizing proxy replaces it with the token, then the agent reads secret.txt
    • skinfaxi 2mo ago
      It only replaces the token in the HTTP header that is sent to the server. Whatever you wrote in your files isn't touched by the proxy.
      • stavros 2mo ago
        It sends a request to requestb.in and reads the public log of the headers. There are ways.
        • skinfaxi 2mo ago
          But requestb.in is not api.github.com so the proxy wouldn't replace anything.
    • drdexebtjl 2mo ago
      Maybe the tokenizing proxy could work both ways? If the agent tries to read secret.txt, it gets back the placeholder.
    • messh 2mo ago
      Couldn't it then just publish the mock in a public place... it would get replaced by the real secret.? How is this prevented