Security Issue: API key visible in repo about bluto HOT 3 CLOSED

On Aug 9, 2018, 10:17 AM -0400, Darryl ***@***.***>, wrote: Hi Thanks for pointing it out however, this was intentional and by design. On Thu, 9 Aug 2018, 14:03 Adam M. Swanda, ***@***.***> wrote: > @darryllane <https://github.com/darryllane>, Inside general.py you > hard-coded your ipstack.com API key into the code. This represents a data > leak and security issue for yourself. You should definitely remove this > since anyone can now just use your key and burn your limits. I may or may > not have tested it to ensure it is indeed an active key. > > *Offending source code:* > general.py#L137-L142 > > My suggestion (I do this for most projects) is that if you do need API > keys, create a separate file for them that the user must fill out. For > example, a JSON file with each service as the key and value as the API > token and only read from that file when needed --- and of course, don't > upload your own version of the API file ;-) > > — > You are receiving this because you were mentioned. > Reply to this email directly, view it on GitHub > <#21>, or mute the thread > <https://github.com/notifications/unsubscribe-auth/AIUu5eAI09ZjiyR_THHV4CmNJ1ij0-7Jks5uPDM_gaJpZM4V1pyl> > . > — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub, or mute the thread.