Environment Variables

[safesploit]

Store sensitive environment variables (like database passwords) securely in a .env file and use them in docker-compose.yml.

This will make it easier to manage sensitive information without exposing it directly in the configuration.

[safesploit]

Create a .env File

Create a .env file in the same directory as docker-compose.yml.

APACHE_PORT=8080
MYSQL_ROOT_PASSWORD=mysecretpassword

[safesploit]

Hard-coded values

• build.sh
• config/doogle-user.sql

Modify docker-compose.yml

At present docker-compose.yml already uses environment variables. So we can ignore the need to replace hard-coded values in the docker-compose.yml.

Modify build.sh

build.sh has hard-coded values

This can be resolved as such:

hard-coded

link

$dbpass = "PASSWORD_HERE";

environment variable

\$dbpass = '${MYSQL_ROOT_PASSWORD}';

[safesploit]

.gitignore

# macOS system files
.DS_Store

# Ignore directories containing generated files (add more as needed)
/vendor/
/node_modules/

[safesploit]

Use a Secrets Manager

HashiCorp Vault