SecretSpec 发布了 dotenv-ng，称 dotenvy 更改了一个 bcrypt 凭证

Domen Kozar 的分支让 SecretSpec 能控制用于其凭据迁移路径的解析器的修复和发布。

By · Published

Primary source: SecretSpec

为何重要

如果解析器先更改了它们，迁移工具就无法安全地将凭据从 .env 文件中移出。该分支授予 SecretSpec 对其安全边界内一个依赖项的控制权。

An exploded diagram shows the internal components of the dotenv-ng parser correctly handling an environment variable file containing a bcrypt secret and literal dollar signs.

Domen Kozar, the founder of Cachix, released dotenv-ng 1.0 after SecretSpec found that the Rust dotenvy parser it used could silently change a credential while reading a .env file.…

When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.

Reader comments

Conversation for this story loads after sign-in.