Hacker News Reader

Parent Full thread

xytop

Another biiiiiiiiiiigest hole is config :)

https://github.com/beansight/beansight-website/blob/master/c...

Guys,

you had to hide your gmail account user/pass

had to hide facebook keys

twitter keys

application secret..

I just successfully authorized on gmail with your account and can read lots of mails, responses.. not saying that I can send emails on your behalf..

View on HN

Thanks. The DB credentials were in variables, but not these. I am changing the mail credentials. Regarding TW and FB login, application have been disabled as social login are not properly working anymore and we don't have the manpower to fix them.

np, don't forget to clear commit history for config :)

some of db details are in history too

And that's now done. Thanks. They were old DB details, but anyway, I cleaned the file.

And I don't want to pile up on the guys, and I'm happy that they open sourced they code, but this is why you really need a bit more professionalism and yes, a bit oversight in our profession. While I doubt it, xytop (and many others) were able to log into your email account, collect addresses, spammed contacts, etc.

Please, be careful with these kinds of things.

Apart from that, thanks for open sourcing it. Not my choice of framework but I'm sure others will find it a valuable source of knowledge.

Reply on news.ycombinator.com