Jeremie Fraeys
|
412d7b82e9
|
security: implement comprehensive secrets protection
Critical fixes:
- Add SanitizeConnectionString() in storage/db_connect.go to remove passwords
- Add SecureEnvVar() in api/factory.go to clear env vars after reading (JWT_SECRET)
- Clear DB password from config after connection
Logging improvements:
- Enhance logging/sanitize.go with patterns for:
- PostgreSQL connection strings
- Generic connection string passwords
- HTTP Authorization headers
- Private keys
CLI security:
- Add --security-audit flag to api-server for security checks:
- Config file permissions
- Exposed environment variables
- Running as root
- API key file permissions
- Add warning when --api-key flag used (process list exposure)
Files changed:
- internal/storage/db_connect.go
- internal/api/factory.go
- internal/logging/sanitize.go
- internal/auth/flags.go
- cmd/api-server/main.go
|
2026-02-18 16:18:09 -05:00 |
|