Conversation
🚨 BugBot couldn't runSomething went wrong. Try again by commenting "bugbot run", or contact support (requestId: serverGenReqId_ab9ab07b-1aa9-455b-aca8-634557094a09). |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Bug: Dev Workflow Exposes Production Secrets
The deploy.dev.yaml workflow now injects production (FAIRMINT_MAINNET_*, TRANSFER_AGENT_MAINNET_CLIENT_SECRET) and DEVNET secrets into the dev runner and container. This exposes live-environment credentials on the less-trusted development host, creating an unnecessary security risk and increasing the blast radius if compromised. The workflow will also fail if these new secrets are not defined in the "dev" GitHub environment.
.github/workflows/deploy.dev.yaml#L58-L65
open-captable-protocol/.github/workflows/deploy.dev.yaml
Lines 58 to 65 in dff77a3
Was this report helpful? Give feedback by reacting with 👍 or 👎
2 participants
What?
Please describe what you're trying to accomplish in this PR.
Why?
What problem does this solve? Why is this important? What's the context?
Screenshots (optional)