security issue, need to talk asap
Closed this issue · 4 comments
I don't want to go into details, but I tweeted you on Twitter. There is a severe security issue that needs to be addressed. I would love to help you with it, but this isn't something I can pull and fix. It's more complicated.
After this was peer reviewed by other researchers it has been deemd not a problem.
Since this was not an issue, would you mind describing the possible concern?
It was related to the .helm/secret-values.yaml file where I store encrypted versions of credentials used during deploys. It's not necessarily obvious from the format, but these values are encrypted (using Werf secrets), so after discussing the encryption format Werf uses (it could perhaps be stronger, but it defaults to AES-CBC-128), this shouldn't be a problem as long as the encryption key stays secret. But I appreciate anyone raising potential security concerns!