Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

private keys leaked? #1

Closed
miguelangel-dev opened this issue Sep 9, 2020 · 2 comments
Closed

private keys leaked? #1

miguelangel-dev opened this issue Sep 9, 2020 · 2 comments

Comments

@miguelangel-dev
Copy link

miguelangel-dev commented Sep 9, 2020 •
edited
Loading

Even if these keys were used in the pilot, they should not be committed.

  • RadarCovid/Supporting: pinning certs, and private keys are exposed here.
  • RadarCovid/Config: endpoints together hardcoded pre/pro keys.

They have been compromised, so:

  1. .gitignore should be updated accordingly, adding these 2 rules, and removing the current ones.
  2. Certs rotation should be done after reviewing Android app.
@alvaro-octal
Copy link

Both directories only contain public keys

@miguelangel-dev
Copy link
Author

Yep, you are right, I have reviewed it again, and it seems to be public.

@miguelangel-dev miguelangel-dev changed the title Private keys leaked private keys leaked? Sep 9, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@alvaro-octal @miguelangel-dev