GITHUB_SECRET stored in unsafe place in .env at Get Set for our Back End Development Projects challenge

[myprtfl]

Challenge Name

https://www.freecodecamp.com/challenges/get-set-for-our-back-end-development-projects

Issue Description

GITHUB_SECRET stored in .env file at cloud9 workspace.
The workspace is set to public as shown in step 2 / 14.
Any one with a cloud9 account can have access to the GITHUB_SECRET.
This against Github document https://developer.github.com/guides/basics-of-authentication/
"The Client Secret should not be shared!"

Screenshot

Demonstrate access as a guest to the .env file at workspace shown in the challenge https://ide.c9.io/happycoder42/test.

[raisedadead]

Cloud Nine allows one private repo per developer. I recommend you make your repo private and only the application URI public so that anyone can still see the demo, whilst securing the repo codebase.

We could do a wiki on that.

[myprtfl]

Without known the risk, learners may put other sensitive date like database connection url with password in this location.
This may bring other risks.
For example lost of other accounts the learner owns if they have the same password.
A chance to introduce some information security basics.

[raisedadead]

@myprtfl yup I complete understand and agree what you mean, and just to assure you we have something planned on that as well, refer #6669

[raisedadead]

Closing as decayed.