Questions tagged [environment-variables]
The environment-variables tag has no usage guidance.
12 questions with no upvoted or accepted answers
3
votes
0
answers
127
views
Are environmental variables for web PaaS a bad security smell?
I'm seeing a trend for deploying web apps to PaaS that the config is typically defined in environmental variables. e.g. Azure Functions or .net core apis
Assuming this has been done to follow good ...
- 319
2
votes
1
answer
711
views
Why are environment variables safe after 2022 Heroku breach?
In their communication about the april 2022 breach (summary here), Heroku states that environment variables (other than Review apps and CI variables) were safe because they are encrypted at rest.
We ...
2
votes
0
answers
344
views
Is it safe to retrieve GnuPG public/secret key with fs in Node.js?
So there is a Node.js package openpgp which is available for signing documents with GPG, but it requires public/secret key. We all know putting key right into the file is dangerous and not recommend ...
- 223
2
votes
0
answers
225
views
Protecting the password in a PBE scheme for an application
I am currently formulating security best practices and requirements for ongoing Java software development in my department and have settled with a recommendation of using the Jasypt framework for ...
- 1,092
2
votes
0
answers
176
views
Node.js ENV VAR Security
Recently I had a debate with a fellow dev about where to store Node.js env vars.
I always use .env files and load these as proper ENV VARs at runtime, however my fellow dev uses JSON config files and ...
- 2,859
2
votes
0
answers
144
views
Is there anything inherently insecure in setting a custom environment variable to a request parameter?
Imagine I have the following rails endpoint:
def configure_welcome_message
ENV['myapp_welcome_message'] = params[:welcome_message]
end
Aside from the fact that this is an inane way to set a ...
Devon Parsons
1
vote
0
answers
546
views
Can modifying environment variables in Windows cause vulnerability?
As normal user, if you open the Edit Environment Variable setting in Windows, you will get this:
As you can see, the %path% variable that available for an user is a combination of %path% set globally ...
- 111
1
vote
0
answers
1k
views
Digital Ocean ENV Variables - .env file, ENV Variables, or something else
Does Digital Ocean have something similar to Credstash or AWS Secrets Manager (both AWS services)?
Trying to decide on the most secure way to store environmental variables with sensitive information (...
- 111
1
vote
0
answers
197
views
Trust boundaries for webapps (vs desktop apps)
I am currently working on fixing some security problems with our webapp as reported by VeraCode. Some of these pertain to "trust boundaries", i.e, what inputs can be trusted.
In some cases, our ...
- 117
0
votes
1
answer
124
views
how to protect a string (secret key) in my env file in node.js project?
I have a node.js project which implement in nest.js framework.
there is some apiKey and secretKey in my env file, I want to protect these keys from anyone, even host administrator. so I compile my ...
- 101
0
votes
0
answers
89
views
Which system variables are exposed from browser JavaScript context?
I know that the TZ variable aka TimeZone can be read by servers, especially with fingerprinting.
What are the exposed variables to browser's ?
- 101
0
votes
1
answer
183
views
Secret security in containerised environment
I've been having a discussion with a developer about storing sensitive information in environment variables. Specifically within a containerised environment such as Azures Container apps.
Background ...
- 123