Giter VIP home page Giter VIP logo

aggregator's People

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar

aggregator's Issues

安全性改进建议

问题描述

目前把域名、账户、密码等信息直接明文保存在json文件里,虽然说明中提到要“修改项目为私有”并付有方法链接,但是:

一方面,github不允许直接在设置中将fork仓库转为私有
image

另一方面,即使是私有仓库,也不建议把这类敏感信息明文存在仓库中

目前这70多个fork里面已经可以看到不少账户密码泄露的情况

解决思路

针对前者

若要修改项目为私有,必须通过导入代码的方式导入到私有仓库
image

或者在本地使用git操作,类似于

git clone --bare https://github.com/aaa/public-repo && cd public-repo
git push --mirror https://github.com/bbb/private-repo

但是这样创建的仓库不会显示在fork里,也难以直接拉取新的commit

针对后者

更建议的方式是把敏感信息存在secrets里 -> 官方文档,然后使用环境变量传递给脚本

一个思路是把整个json文件的内容去掉空格换行(或者用base64编码一下)作为一整个字符串传入

另一个思路是把敏感信息用rsa加密,公钥和加密后的字符串保存在仓库中,私钥通过secrets传入

希望您能考虑一下

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.