Tokens visible in process lists; credentials in remote URLs shown in UI #11

New Issue

2026-10-07T20:04:28-04:00

jared commented

2026-10-07 20:04:28 -04:00

Source: engineering review, 2026-10-07.

Gitea and Grafana tokens are passed as -H "Authorization: …" on curl's command line (bin/devdesk gitea_get, cmd_alerts), visible in ps every 15–30s.
A git remote URL with embedded credentials is displayed as-is in the Repo panel.

Fix: pass headers via -H @file or curl -K - on stdin, and strip userinfo from remote URLs before output.

_Source: engineering review, 2026-10-07._ - Gitea and Grafana tokens are passed as `-H "Authorization: …"` on curl's command line (`bin/devdesk` `gitea_get`, `cmd_alerts`), visible in `ps` every 15–30s. - A git remote URL with embedded credentials is displayed as-is in the Repo panel. **Fix:** pass headers via `-H @file` or `curl -K -` on stdin, and strip userinfo from remote URLs before output.

jared added this to the v0.5.0 hardening + header/phone milestone 2026-10-07 20:04:28 -04:00

jared added the security label 2026-10-07 20:04:28 -04:00

jared referenced this issue from a commit

2026-10-07 20:15:50 -04:00

fix: v0.5.0 security and robustness fixes from the 2026-10-07 review

jared closed this issue

2026-10-07 20:15:50 -04:00

Sign in to join this conversation.