Skip to content

security: .env.example contains real RSA private key and worker secret as example values #4706

@Youngyz1

Description

@Youngyz1

Description

The .env.example file contains what appears to be a real RSA private key
and worker secret used as example values rather than placeholder strings.

Specifically:

  • Line with WORKER_RUNS_PRIVATE_KEY contains a base64-encoded value that
    decodes to a valid -----BEGIN RSA PRIVATE KEY----- block
  • Line with WORKER_SECRET contains a real 256-bit secret value

Risk

Any operator who copies these values directly into their production .env
without generating new keys will be running with publicly known credentials.
An attacker with access to this repo can use these keys to authenticate as
a worker to any Lightning instance using the example values.

Suggested Fix

Replace the real key material with generation instructions:

# WORKER_RUNS_PRIVATE_KEY="generate with: mix lightning.gen_worker_keys"
# WORKER_SECRET="generate with: mix lightning.gen_worker_keys"

The DEPLOYMENT.md already documents mix lightning.gen_worker_keys
pointing to it from the .env.example is safer than providing real keys.

Steps to Verify

echo "LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQ..." | base64 -d
# Returns a valid RSA private key

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugNewly identified bug

    Type

    No type

    Projects

    Status

    New Issues

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions