-
Notifications
You must be signed in to change notification settings - Fork 12
Add detection for sensitive config values in Compose files #1038
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
If you can, maybe add some comments to the jsonCfg
, so that we can easily understand how the config values relate to the problem we are solving.
Good job on this!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
nits
Co-authored-by: Lio李歐 <[email protected]>
Description
Detects potentially sensitive environment variables in Compose files, and gives a warning for the user to use
defang config set ENV_VAR
to securely store those values.It uses various detectors from https://github.com/DefangLabs/secret-detector to detect secrets, including:
aws_client_id
,github
,high_entropy_string
,keyword
,url_password
.Linked Issues
Fixes #938
Checklist