Staging's database password was published in a paste

HighLikelyOpenTunde Martinsfix by 12 Nov

Open · with Tunde

Tunde has it, due on 12 Nov

Nothing's blocking it. It closes when the check that found it stops seeing it.

Where it came from, and where it is

One problem in one place, found by dark web.

1 source · 1 place

Dark web
Dark web monitoring
A public paste site, in a dump of 212 .env files scraped from the web
- A public paste site, in a dump of 212 .env files scraped from the webDatabase URL and a Paystack key, in a dump of 212 scraped .env filesOpen

What closes it

Not yet: Every step in its dark web case is done, and nothing new turns up

Nobody can mark it fixed by hand. A person submits the fix; a scan or a retest decides it.

Why it ranks here

18th of 39 in your queue

Proof first, then exploitation in the wild, a public exploit, EPSS and severity, adjusted for exposure and how much the asset matters

Priority

56 / 100

High Where its severity starts it44
Straight onto the internet Its own address answers, with nothing in front+8
Criticality B It supports the crown jewels+4
Its priority56

The evidence

What each source saw

As each source gives it · secrets, keys and card numbers stay masked

The post · a public paste site · Tue 13 Oct, 14:03

Open its dark web case

# staging.tessellatepay.com/.env
APP_ENV=staging
APP_DEBUG=true
DATABASE_URL=postgres://tess_app:••••••@staging-db.internal:5432/tessellate
PAYSTACK_SECRET_KEY=sk_test_••••••••

Why it matters here

This is the difference between exposed and taken. Anyone who read the paste has your staging database password, and staging credentials are often the same as production's.

How sure we are

It's the same file, line for line, as the one our scan found on staging on 12 Oct.

What to do

Change the staging database password, and production's if it's the same
Roll the Paystack test key
Block dotfiles at nginx so the next scrape finds nothing
Ask the paste site to take it down

Activity

What happened, and what was said

1 event · 0 comments · oldest first

SecureAssure found it on the dark webTue 13 Oct, 14:03

⌘ Enter to send

Joined to

2 findings belong with this one

The same story from another source: fix them together

# staging.tessellatepay.com/.env APP_ENV=staging APP_DEBUG=true DATABASE_URL=postgres://tess_app:••••••@staging-db.internal:5432/tessellate PAYSTACK_SECRET_KEY=sk_test_••••••••