if your .env.example has a real-looking secret in it…
Fatima Al-Sayed@fatima_appsec
if your .env.example has a real-looking secret in it, someone will deploy it to production unchanged. use CHANGE_ME and make the app refuse to start when it sees it. ask me how i know
Written by
Fatima Al-Sayed
Application security engineer at a bank in Dubai. Threat modelling, auth flows, secure code review. I will ask where your JWT secret lives. Arabic coffee enthusiast.
Get the best of Dynamo Geeks weekly
One email each Monday with the most useful posts. No spam; unsubscribe in one click.
Comments
Sign in to join the conversation.
Sign in to commentMarcus Johnson@marcus_oncall
the app refusing to boot is so underrated. same for admin/admin defaults on internal tools
Rachel Kim@rachelkim
Adding this to our launch checklist. Also, "ask me how I know" is doing a lot of work in this sentence.