espocrm-extensions/extension-platform
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(security): require DB_PASS and GITEA_TOKEN env vars

Browse Source 
Removed hardcoded fallback secrets in app_server.py. Both env vars
are now required at startup — fail fast instead of silently using
production credentials baked into the source.

Why: discovered while mapping the leak radius of a separate Gitea
token during the LegalCrm 2026-04-25 security audit. Per the
Infisical-only secrets policy, hardcoded credentials in any source
file are Critical regardless of intent.

Note: deployment must set both env vars before restarting the
service; missing either now produces KeyError on startup.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Chaim Marcus
2026-04-25 20:34:40 +00:00
parent 740866eb1c
commit 686a07e088
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app_server.py
+3 -2
View File
@@ -34,10 +34,11 @@ DB_HOST = os.environ.get('DB_HOST', 'pss404gosg8oo0o8k40o4wco')
DB_PORT = int(os.environ.get('DB_PORT', '5432')) DB_PORT = int(os.environ.get('DB_PORT', '5432'))
DB_NAME = os.environ.get('DB_NAME', 'extension_platform') DB_NAME = os.environ.get('DB_NAME', 'extension_platform')
DB_USER = os.environ.get('DB_USER', 'postgres') DB_USER = os.environ.get('DB_USER', 'postgres')
DB_PASS = os.environ.get('DB_PASS', '9cugHhKR8bCFXzm') # Required env vars — fail fast if missing rather than fall back to a baked-in secret.
DB_PASS = os.environ['DB_PASS']
GITEA_URL = os.environ.get('GITEA_URL', 'https://gitea.dev.marcus-law.co.il') GITEA_URL = os.environ.get('GITEA_URL', 'https://gitea.dev.marcus-law.co.il')
GITEA_TOKEN = os.environ.get('GITEA_TOKEN', '90acb3ebc0f98edfb7a373ef9902bde1cc8eff96') GITEA_TOKEN = os.environ['GITEA_TOKEN']
GITEA_ORG = os.environ.get('GITEA_ORG', 'espocrm-extensions') GITEA_ORG = os.environ.get('GITEA_ORG', 'espocrm-extensions')
DIST_DIR = os.environ.get('DIST_DIR', '/app/dashboard/dist') DIST_DIR = os.environ.get('DIST_DIR', '/app/dashboard/dist')