Overview
Per a discussion with @rseldner we noticed ecctl stores API key in plaintext.
This is insecure.
Possible Implementation
We would propose to store key in keychain (macOS) or credential manager (WinOS), etc.
If hard, then avoid saving it in $HOME/.ecctl/config.json, but let user specify it in env variables or bash_profiles, to reduce risk.
Testing
n/a
Context
given api key is extremely important to ops the deployment, we should keep it safe and secure
Your Environment
macOS
Overview
Per a discussion with @rseldner we noticed ecctl stores API key in plaintext.
This is insecure.
Possible Implementation
We would propose to store key in keychain (macOS) or credential manager (WinOS), etc.
If hard, then avoid saving it in
$HOME/.ecctl/config.json, but let user specify it in env variables or bash_profiles, to reduce risk.Testing
n/a
Context
given api key is extremely important to ops the deployment, we should keep it safe and secure
Your Environment
macOS