thyrfa

2 ms·

1. 1.▲
   by thyrfa 1y ago

   Not at that time though, right, considering it was dumped? You have changed since, which is good, but under a year ago had it as just an env var
2. 2.▲
   by thyrfa 1y ago

   How can you guarantee that nobody ripped the private key before the researcher told you about the issue though?
3. 3.▲
   by thyrfa 1y ago

   It is incredibly bad practice that their "become the github app as you desire" keys to the kingdom private key was just sitting in the environment variables. Anybody can get hacked, but that's just basic secrets management,