Possible security issue: hard-coded password
akondasif opened this issue · 3 comments
Greetings,
We are security researchers and we are looking for insecure coding patterns and configurations in the microservice architecture repositories. In your repository, we have found instances of hard-coded passwords. According to CWE, "A hard-coded password typically leads to a significant authentication failure that can be difficult for the system administrator to detect."
Hopefully, you agree and will fix it.
Source: https://github.com/openlab-red/quarkus-mtls-quickstart/blob/master/quarkus-server-mtls/src/main/resources/application.properties and https://github.com/openlab-red/quarkus-mtls-quickstart/blob/master/quarkus-client-mtls/src/main/resources/application.properties
Thanks @akondasif but it's a showcase application not a production grade application. I will make a note on the properties file.
Just for your information the "hard coded" value can be used for local development, and all those properties can be overridden at runtime with an external configuration file.
Where can I open an issue against your bunch of scripts to make them smarter?
Thanks for the feedback.
Where can I open an issue against your bunch of scripts to make them smarter?
As soon as our paper is peer-reviewed we will make our tool open source and let the community to make the tool better :)
Awesome! you should consider to publish under OpenAccess.