jjjake / fma-to-ia Goto Github PK

Hi,

I'm almost sure you've done this accidentally, but I felt that you should be aware that you've embedded your API key in a public repository. This is a security concern because anyone with access to your key can send requests on your behalf. This issue can be found here, and here.

Suggested Mitigations:

Placeholders:

1. Use an empty string or placeholder such as "your_api_key" to represent the API key.
2. Use a separate configuration file that would act as a template. Meaning, the template would contain a value that would reference the API key. When committing the template file, this value would be left blank indicating that this should be configured. Keep in mind that this only separates your code and the keys (disregards anyone with physical access to your machine).
3. If possible, regenerate a new API key.

Git History:

Because your key can still be indexed via your repository's history, you will also need to purge the sensitive data. Luckily, Github provides a step-by-step easy tutorial for this: tutorial.

– sk3ptus