move proxy router cmd args to env variables #323
Conversation
![codereviewbot-ai[bot]](https://avatars.githubusercontent.com/in/309638?s=60&v=4){kind=small}
| `--log-level-proxy=${process.env.LOG_LEVEL_PROXY}`, | ||
| `--log-level-connection=${process.env.LOG_LEVEL_CONNECTION}`, | ||
|
|
||
| `--wallet-private-key=${config.privateKey}`, |
There was a problem hiding this comment.
The private key is being passed as a command line argument. This is a security risk because command line arguments can be viewed by any user on the system using commands like 'ps'. It's also possible that the command line arguments could be logged somewhere, exposing the private key.
Instead of passing sensitive data like private keys as command line arguments, consider using a more secure method. For example, you could read the private key from a file with appropriate permissions, or use environment variables if the environment is secure and isolated.
| `--log-level-proxy=${process.env.LOG_LEVEL_PROXY}`, | ||
| `--log-level-connection=${process.env.LOG_LEVEL_CONNECTION}`, | ||
|
|
||
| `--wallet-private-key=${config.privateKey}`, |
There was a problem hiding this comment.
The private key is being passed as a command line argument. This is a security risk because command line arguments can be viewed by any user on the system using commands like 'ps'. It's also possible that the command line arguments could be logged somewhere, exposing the private key.
Instead of passing sensitive data like private keys as command line arguments, consider using a more secure method. For example, you could read the private key from a file that has strict permissions, or use environment variables if you ensure they are not logged or exposed in other ways.
| `--log-level-connection=${process.env.LOG_LEVEL_CONNECTION}`, | ||
| `--log-folder-path=${app.getPath("logs")}/`, | ||
|
|
||
| `--wallet-private-key=${config.privateKey}`, |
There was a problem hiding this comment.
The private key is being passed as a command line argument. This is a security risk because command line arguments can be viewed by any user on the system using commands like ps or by inspecting the /proc filesystem. It's also possible that the command line arguments could be logged by the system or by third-party monitoring tools, which would expose the private key.
Instead of passing sensitive data like private keys as command line arguments, consider using a more secure method. For example, you could read the private key from a file with appropriate permissions, or use an environment variable. If you use an environment variable, make sure it's not logged or exposed in other ways.
No description provided.