Spring Boot's /actuator/env Sanitizer Can Leak Secrets With Non-Standard Variable Names

·1 views

Spring Boot's built-in sanitizer for the /actuator/env endpoint masks values only when property names contain keywords like 'password', 'secret', 'token', or 'key'. Variables with unconventional names such as DB_PASS, WEBHOOK_SIGNING, or PARTNER_SHARED_VALUE fall outside these defaults and are exposed in plain text. Enabling authorization controls via 'show-values=when-authorized' addresses who can access the endpoint but does not prevent unmasked secrets from appearing to authorized users. The Spring Boot documentation provides a configurable SanitizingFunction interface to extend masking behavior, but determining which project-specific names to include remains the developer's responsibility. Security gaps most often arise from ad-hoc naming conventions adopted under deadline pressure that are never audited against the sanitizer's pattern list.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

AI Agents Often Run on Human Credentials, Creating Enterprise Security Blind Spots

Many AI agents deployed in enterprises lack their own distinct identities and instead operate using API keys, tokens, and credentials originally issued to humans or workloads. Because no enterprise identity provider typically mediates these exchanges, agent activity can fall outside standard governance and access reviews. Security experts warn that the problem is fundamentally about unmanaged secrets before it becomes an identity issue. Organizations are advised to first locate where agent credentials reside and who owns them, while simultaneously blocking new credential exposure. The recommended end state is replacing reusable, standing credentials with agent-specific or delegated identities backed by scoped, short-lived tokens that limit the damage if compromised.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds tool to make git diff understand JSON and YAML structure

A developer created a custom tool to give git diff semantic awareness of structured data formats like JSON and YAML, after a Kubernetes manifest formatter reordered keys and produced noisy, misleading diffs. Git offers two extension points for this: an external diff driver that fully replaces the diff output, and a textconv filter that normalises file content before comparison. A key discovery was that these two hooks behave differently across git commands — the external driver only activates for git diff, while history commands like git log -p and git show fall back to textconv. Several edge cases required careful handling, including invalid mid-edit files that could abort an entire diff run, temp files without reliable extensions, and encoding issues that could silently erase content. The author recommends starting with a simple shell shim for existing tools, but notes a dedicated subcommand offers better error messaging, cross-platform support, and more reliable file-type detection.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Duplicate Consent Records: Why a Stable Event ID Is Essential for Compliance

When a customer withdraws marketing consent, that single action can trigger multiple system deliveries due to network failures, webhook timeouts, or queue replays in distributed architectures. Without a mechanism to distinguish a redelivered message from a new customer decision, consent history logs may incorrectly record the same withdrawal twice. This creates serious risks for Privacy, Compliance, and Legal teams who rely on accurate consent histories to understand user intent. A stable, unique event ID — assigned once per consent action and retained across retries — allows receiving systems to recognize and discard duplicates without creating false records. Industry standards such as the CloudEvents specification from the Cloud Native Computing Foundation already recommend this approach for exactly this reason.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Custodial Services Can Issue Deposit Addresses Without Holding Private Keys

A software developer has published a Python package called chain-addresses that allows custodial services to generate cryptocurrency deposit addresses using only an extended public key, eliminating the need to expose private keys on internet-facing servers. The approach derives deposit addresses from an account-level extended public key, separating address issuance from spending authority entirely. Traditional methods that ask a node for a fresh address bundle key custody, address gap tracking, and wallet recovery into a single component reachable via HTTP, creating a broad attack surface. The package explicitly refuses hardened derivation paths and private key inputs, making the security boundary a verifiable code property rather than a configuration assumption. It supports multiple address encodings including Bitcoin P2WPKH, P2TR, and EVM formats, mapping a single derived public key to several address types.

0 comments Read more at DEV Community