hum3/gomail
Watch
1
0
Fork
You've already forked gomail
 0
Code Issues 2 Pull requests Projects Releases Packages Wiki Activity Actions

Move Azure client secrets out of .vscode/launch.json #2

New issue
Open
opened 2026-08-07 14:23:09 +00:00 by hum3 · 0 comments
hum3 commented 2026-08-07 14:23:09 +00:00
Owner
Copy link

.vscode/launch.json contains live Azure AD credentials in plaintext under the env block of multiple launch configurations:

  • CLIENT_ID
  • CLIENT_SECRET
  • CLIENT_SECRET_ID
  • OBJECT_ID
  • TENANT_ID

Not urgent — the Codeberg repo is private and the GitHub mirror appears to be as well. But this is a latent footgun:

  • Any future push of the repo to a public remote leaks the secret.
  • git log preserves it even after removal, so rotation will be required eventually.
  • Anyone added as a collaborator gets the live secret.

Proposed fix

  1. Move the env vars into a gitignored .env file (project already uses godotenv).
  2. Reference it from launch.json via "envFile": "${workspaceFolder}/.env" instead of the inline env block.
  3. Add .env to .gitignore if not already there.
  4. Commit a .env.example template with the keys but no values.

When to rotate

Rotate the client secret in Azure AD before making either remote public, or if the repo is ever shared with a new collaborator.

Migrated from Codeberg: originally #2, opened 2026-04-18.

`.vscode/launch.json` contains live Azure AD credentials in plaintext under the `env` block of multiple launch configurations: - `CLIENT_ID` - `CLIENT_SECRET` - `CLIENT_SECRET_ID` - `OBJECT_ID` - `TENANT_ID` Not urgent — the Codeberg repo is private and the GitHub mirror appears to be as well. But this is a latent footgun: - Any future push of the repo to a public remote leaks the secret. - `git log` preserves it even after removal, so rotation will be required eventually. - Anyone added as a collaborator gets the live secret. ### Proposed fix 1. Move the env vars into a gitignored `.env` file (project already uses `godotenv`). 2. Reference it from `launch.json` via `"envFile": "${workspaceFolder}/.env"` instead of the inline `env` block. 3. Add `.env` to `.gitignore` if not already there. 4. Commit a `.env.example` template with the keys but no values. ### When to rotate Rotate the client secret in Azure AD **before** making either remote public, or if the repo is ever shared with a new collaborator. --- *Migrated from Codeberg: originally [#2](https://codeberg.org/hum3/gomail/issues/2), opened 2026-04-18.*
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
v0.8.6
v0.8.5
v0.8.4
v0.8.3
v0.8.2
v0.8.1
v0.8.0
v0.5.9
v0.0.6
v0.0.5
v0.0.4
v0.0.3
v0.0.1
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
hum3/gomail#2
No description provided.