GOOGLE_OAUTH_SECRET is passed to script as env var and can be retrieved

[yosefy]

is passed to script as ENV VAR
is it by design?

thanks

[bugy]

Hi @yosefy, script server propagates all environment variables from the OS to the running script. So I believe you have GOOGLE_OAUTH_SECRET as your secret in OS, is it correct?

[yosefy]

Yes I set it in systems service, but how else can I do it. ?

…

On Fri, Aug 6, 2021, 10:19 AM Iaroslav Shepilov ***@***.***> wrote: Hi @yosefy <https://github.com/yosefy>, script server propagates all environment variables from the OS to the running script. So I believe you have GOOGLE_OAUTH_SECRET as your secret in OS, is it correct? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#478 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADCXF3NSUX5G7TYEDN5W6S3T3OEJHANCNFSM5BUFG7KQ> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&utm_campaign=notification-email> .

[bugy]

Unfortunately, there is no way to hide it :( I would call it a bug (security issue).