Skip to content

Add detection for sensitive config values in Compose files #1038

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 29 commits into from
Mar 5, 2025

Conversation

commit111
Copy link
Collaborator

Description

Detects potentially sensitive environment variables in Compose files, and gives a warning for the user to use defang config set ENV_VAR to securely store those values.

It uses various detectors from https://github.com/DefangLabs/secret-detector to detect secrets, including: aws_client_id, github, high_entropy_string, keyword, url_password.

Linked Issues

Fixes #938

Checklist

  • I have performed a self-review of my code
  • I have added appropriate tests
  • I have updated the Defang CLI docs and/or README to reflect my changes, if necessary

Copy link
Member

@jordanstephens jordanstephens left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If you can, maybe add some comments to the jsonCfg, so that we can easily understand how the config values relate to the problem we are solving.

Good job on this!

Copy link
Member

@lionello lionello left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nits

@lionello lionello merged commit b5279a1 into main Mar 5, 2025
12 checks passed
@lionello lionello deleted the linda-warn-config branch March 5, 2025 01:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Warn users about secret config values
4 participants