Skip to content

prevent leaking of credentials #230

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
vks opened this issue Dec 7, 2015 · 2 comments
Closed

prevent leaking of credentials #230

vks opened this issue Dec 7, 2015 · 2 comments
Labels
C-enhancement ✨ Category: Adding new behavior or a change to the way an existing feature works

Comments

@vks
Copy link

vks commented Dec 7, 2015

It is very common to leak credentials (see this). npm and github have precautions against leaking credentials:

So, the solution for this problem is to: [...] On npm and GitHub side — automatic search for their auth data in public packages/repositories at the time of publishing/committing/making a private repo public, then revoking the leaked tokens and resetting leaked passwords.

Maybe crates.io should implement something like this as well?
@lukaslueg
Copy link
Contributor

This is already discussed over at rust-lang/cargo#2063.

@carols10cents carols10cents added the C-enhancement ✨ Category: Adding new behavior or a change to the way an existing feature works label Dec 15, 2016
@Eh2406
Copy link
Contributor

Eh2406 commented Mar 15, 2017

move to close?

@sgrif sgrif closed this as completed Mar 15, 2017
bors added a commit that referenced this issue Dec 18, 2019
@bors
Auto merge of #1978 - rust-lang:dependabot/npm_and_yarn/ember-cli-bab…
f82b392 
…el-6.18.0, r=Turbo87

Bump ember-cli-babel from 6.14.1 to 6.18.0

Bumps [ember-cli-babel](https://github.com/babel/ember-cli-babel) from 6.14.1 to 6.18.0.
<details>
<summary>Changelog</summary>

*Sourced from [ember-cli-babel's changelog](https://github.com/babel/ember-cli-babel/blob/master/CHANGELOG.md).*

> ## v6.18.0 (2018-12-12)
>
> #### 🚀 Enhancement
> * [#257](https://github-redirect.dependabot.com/babel/ember-cli-babel/pull/257) Update babel-plugin-ember-modules-api-polyfill to 2.6.0. ([@&#8203;rwjblue](https://github.com/rwjblue))
>
> #### Committers: 1
> - Robert Jackson ([@&#8203;rwjblue](https://github.com/rwjblue))
>
> ## v6.17.2 (2018-09-14)
>
> #### 🚀 Enhancement
> * [#244](https://github-redirect.dependabot.com/babel/ember-cli-babel/pull/244) Update to ember-rfc176-data@^0.3.5. ([@&#8203;rwjblue](https://github.com/rwjblue))
>
> #### Committers: 1
> - Robert Jackson ([@&#8203;rwjblue](https://github.com/rwjblue))
>
> ## v6.17.0 (2018-08-27)
>
> #### 🐛 Bug Fix
> * [#241](https://github-redirect.dependabot.com/babel/ember-cli-babel/pull/241) Bumping broccoli-babel-transpiler to get the fix for parallelAPI ([@&#8203;arthirm](https://github.com/arthirm))
>
> #### Committers: 1
> - Arthi ([@&#8203;arthirm](https://github.com/arthirm))
>
>
> ## v6.16.0 (2018-07-18)
>
> #### 🚀 Enhancement
> * [#232](https://github-redirect.dependabot.com/babel/ember-cli-babel/pull/232) Upgrade deps ([@&#8203;stefanpenner](https://github.com/stefanpenner))
>
> #### Committers: 1
> - Stefan Penner ([@&#8203;stefanpenner](https://github.com/stefanpenner))
>
>
> ## v6.15.0 (2018-07-17)
>
> #### 🚀 Enhancement
> * [#230](https://github-redirect.dependabot.com/babel/ember-cli-babel/pull/230) update babel-plugin-debug-macros to 0.2.0-beta.6 ([@&#8203;kellyselden](https://github.com/kellyselden))
>
> #### 📝 Documentation
> * [#225](https://github-redirect.dependabot.com/babel/ember-cli-babel/pull/225) Update Changelog ([@&#8203;Turbo87](https://github.com/Turbo87))
>
> #### Committers: 2
> - Kelly Selden ([@&#8203;kellyselden](https://github.com/kellyselden))
> - Tobias Bieniek ([@&#8203;Turbo87](https://github.com/Turbo87))
</details>
<details>
<summary>Commits</summary>

- [`02b851b`](emberjs/ember-cli-babel@02b851b) 6.18.0
- [`724b372`](emberjs/ember-cli-babel@724b372) Merge pull request [#257](https://github-redirect.dependabot.com/babel/ember-cli-babel/issues/257) from rwjblue/update-modules-api-data
- [`d478fb5`](emberjs/ember-cli-babel@d478fb5) Update babel-plugin-ember-modules-api-polyfill to 2.6.0.
- [`29a94cd`](emberjs/ember-cli-babel@29a94cd) 6.17.1
- [`d9f55d6`](emberjs/ember-cli-babel@d9f55d6) Add v6.17.1 to CHANGELOG.
- [`8d9cd93`](emberjs/ember-cli-babel@8d9cd93) Update to ember-rfc176-data@^0.3.4.
- [`c58ae85`](emberjs/ember-cli-babel@c58ae85) 6.17.0
- [`5486b3e`](emberjs/ember-cli-babel@5486b3e) Add recent releases to changelog...
- [`ec3f25c`](emberjs/ember-cli-babel@ec3f25c) Merge pull request [#241](https://github-redirect.dependabot.com/babel/ember-cli-babel/issues/241) from arthirm/master
- [`af16202`](emberjs/ember-cli-babel@af16202) Bumping broccoli-babel-transpiler
- Additional commits viewable in [compare view](emberjs/ember-cli-babel@v6.14.1...v6.18.0)
</details>
<br />

[![Dependabot compatibility score](https://api.dependabot.com/badges/compatibility_score?dependency-name=ember-cli-babel&package-manager=npm_and_yarn&previous-version=6.14.1&new-version=6.18.0)](https://dependabot.com/compatibility-score.html?dependency-name=ember-cli-babel&package-manager=npm_and_yarn&previous-version=6.14.1&new-version=6.18.0)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

**Note:** This repo was added to Dependabot recently, so you'll receive a maximum of 5 PRs for your first few update runs. Once an update run creates fewer than 5 PRs we'll remove that limit.

You can always request more updates by clicking `Bump now` in your [Dependabot dashboard](https://app.dependabot.com).

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in the `.dependabot/config.yml` file in this repo:
- Update frequency
- Automerge options (never/patch/minor, and dev/runtime dependencies)
- Out-of-range updates (receive only lockfile updates, if desired)
- Security updates (receive only security updates, if desired)

</details>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
C-enhancement ✨ Category: Adding new behavior or a change to the way an existing feature works
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
5 participants
@vks @carols10cents @sgrif @lukaslueg @Eh2406