4 ms·

Your agent writes secret.txt with the placeholder, and the tokenizing proxy replaces it with the token, then the agent reads secret.txt

• skinfaxi 2mo ago
  It only replaces the token in the HTTP header that is sent to the server. Whatever you wrote in your files isn't touched by the proxy.
  • stavros 2mo ago
    It sends a request to requestb.in and reads the public log of the headers. There are ways.
    • skinfaxi 2mo ago
      But requestb.in is not api.github.com so the proxy wouldn't replace anything.
• drdexebtjl 2mo ago
  Maybe the tokenizing proxy could work both ways? If the agent tries to read secret.txt, it gets back the placeholder.
• messh 2mo ago
  Couldn't it then just publish the mock in a public place... it would get replaced by the real secret.? How is this prevented