1

I'm looking at creating a healthcheck dashboard that at a glance shows you information about all our services including:

  • Are they running
  • What sem version they are running
  • The most recent commit hash of the code they are running.

What I was thinking is that the /healthcheck endpoint would return this information.

Is it safe or dangerous to expose this information?

2 Answers 2

2

The purpose of a cryptographic hash is that it doesn't reveal details about what was hashed, but it can be used to verify those details.

Based on your question, I'm assuming that you want to verify that some service's software matches a version that you have in a version control repository.

If someone has read access to your repo, they'll be able to compare the hashes easily. If your services are based on open source software, then you're simply advertising the version numbers, which is generally considered safe as long as you're updating your software when there is a security release. If your repo is private, then only trusted people will be able to figure out your version number through your status page.

1
  • Basically the intent of revealing the commit hash and sem var is just to help us debug whether 'Ok, that feature hasn't been released yet, you shouldn't be expecting to see it in this environment' etc.
    – dwjohnston
    Commented May 26, 2021 at 6:43
1

Yes, it's probably safe. The commit hash doesn't do anything else than identify a commit in your repo so you can find it if you have access to the repo.

If you for some reason fear that people with access to the repo can identify what commit you're running then you shouldn't do it. If you don't want people to know when you have pushed an update, then you shouldn't do it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .