diff --git a/.gitignore b/.gitignore index db6f12e..e614333 100644 --- a/.gitignore +++ b/.gitignore @@ -160,4 +160,6 @@ cython_debug/ # be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore # and can be added to the global gitignore or merged into this file. For a more nuclear # option (not recommended) you can uncomment the following to ignore the entire idea folder. -#.idea/ \ No newline at end of file +#.idea/ +# Security +credentials.json diff --git a/.jules/sentinel.md b/.jules/sentinel.md index 65407a8..7a78e9d 100644 --- a/.jules/sentinel.md +++ b/.jules/sentinel.md @@ -21,3 +21,16 @@ Hardcoded credentials pose a critical risk because they provide an easy entry po **Prevention:** 1. Never commit secrets, API keys, or passwords into the source code repository. Always read sensitive configuration using environment variables (e.g., `os.getenv`). 2. Implement secure comparisons utilizing functions designed to prevent timing attacks, like `secrets.compare_digest()`, and properly encode inputs to prevent TypeErrors on non-ASCII characters. + +## 2024-05-20 - Exposed Google Service Account Credentials + +**Vulnerability:** +The `credentials.json` file containing sensitive Google Service Account credentials (including private keys and client IDs) was committed to the repository and tracked by Git. + +**Learning:** +Committing secrets and credentials files directly to the repository exposes sensitive systems to unauthorized access and potential data breaches, even in private repositories. It is a critical security risk. + +**Prevention:** +1. Never commit secrets, API keys, or credentials files into the source code repository. +2. Explicitly add known sensitive file names (like `credentials.json`, `.env`) to `.gitignore` to prevent accidental commits. +3. Manage secrets securely outside of version control, using environment variables, secret managers, or securely injected files during deployment. diff --git a/credentials.json b/credentials.json deleted file mode 100644 index be95c3b..0000000 --- a/credentials.json +++ /dev/null @@ -1,13 +0,0 @@ -{ - "type": "service_account", - "project_id": "madhan-construction-app", - "private_key_id": "e897656c2aa5092bac1fa918afdf4f3ed9933cf6", - "private_key": "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCwHHKH1e/jwUY3\nMr4rRf6rboLogHATQoF+dtfybejEUuCbFHlKaiooBL/JtVttxkQq7vNClNQ49tRS\nwH2+BItwzzEBzCzwwa/VN/1UmWLkBTNvjQcnyU9dGjRgMMNakyWntBv0xgZT8eCF\nttH+kxE09UOaDrm45ycJ3fyRzZJBSCIbso0G6AGbXlL6riSYBuqbWWboipViBH4S\nAIF8lfZ3SNnpc2pjPd+355hSPZx/qNa2uAHN3Dy/5Q7gH1tEPYBWAuVoUGAIXVaQ\nRpnSFfyJ31OS9xfQtpfbI+n2F+fmFX4GvAzMydWo90PTzVMBv2FxIrDV8mfMUBtL\nt6tsfrZvAgMBAAECggEABxHtSyS8j7Enp3mjBsu1kJ5MJRda6HsIBdKxkqr06ETH\nfZJR2Dnw3VBrfqaIOBz4iZy0KV0eM/c8yOGvapx2GJ5IwmC3ASdVbsLjqazKuoq2\n6OiJfABp7jvqFF6AyTcVEOl7IdV9VYtlTxjqz0SKMU0TXLDwpcqp14yQ4i2VjIdO\nlgl973XV2lxa5k8SynV8dmwLVA4RrwuDi1kEGO8R0w2TI/AXNMM6Q2q3gTNzeggh\n/HptRkp3jA3qT/RcCAWW30rq/MaGG+PrR0hzVIrhjH/lZ0qJb3DonpfgJF4eFNkE\nzaAi/kF99/fi47LOny+8CerjuwjtJONHBLGGIcNNsQKBgQD1Aw5bYrgmR0GMdw4z\nlJP6TFiaFcU0lXtGc6tSihD3h3LqgNraHjYU5m2NSa2ToScA1x1iJOecT3fx32jH\nP91qQCED7EhODTGSnaKdRfTdsEiIn02yyRXPTIhWkUwXxtvH8uu4pZpONZkPX6Wu\n6i21XqXIhK1agrUIFY6je+Nq+QKBgQC4AloNjBQYai348vCxIceyJFX2jlRW3PXx\nYV4XgKkeQYevoFPB6Ft4DKNOeKh9GO0PUbLHSgO5ZRgiLCQ8/hZwfW50Pq6QbsMm\nZa1dddOo4jSgBg62R1O2/nTHO1ILk5aSHEjsGYQo1DJu3/6Mcs2WgVI59e/lUJII\n/2yTP2DepwKBgBNvxaDMSQ2IU5PgEflXjRGrItA+b+GHBjuFi47Fsyjfzub5h+ML\nyICJ8yDlOmbevuhbKFKT2OfWig5fCcHcuCTop3XXNbkzZL5b0P2nAhDgHjDwakqH\nlzpVuO8dIas1NFQ9WiPQx1fy+ox0qwEgRLYBpycsF1B51ACrLSCdAGKJAoGAW2tP\nsktV8ItQK88HJfnSbP8Adm5gGIfO6Q2m4aZaX13PO8I72qrGRu6AdAweKYiovmOo\nnrp2/zTquI+VsXfLTjgDGF3L/JYK/pileTmA3vcDjj10MbteLBxfiFxAdt/sfsru\nr949estyAwPmQ4EGAzBc2c8GULem1jGQj9d9GSECgYEAsGGNKMpTt2DfBBEpTEVT\nfIy6Kj6c3LTxI3+mDkOs+2jGhwKUkuHtiZjVEOvQKGoXwwBKEJMq4uIu5u7qORMX\nXWdZVxVMValWfqjYCewju9s+2MUJH3RmPBqtVlWw9n1I3E2xxE8eN7TJ3KS5GCNg\nGRt/gEhL9zaNoeyQuGTHpUI=\n-----END PRIVATE KEY-----\n", - "client_email": "madhanconstruction@madhan-construction-app.iam.gserviceaccount.com", - "client_id": "103866831595576905788", - "auth_uri": "https://accounts.google.com/o/oauth2/auth", - "token_uri": "https://oauth2.googleapis.com/token", - "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs", - "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/madhanconstruction%40madhan-construction-app.iam.gserviceaccount.com", - "universe_domain": "googleapis.com" -}