biojupies-plugins icon indicating copy to clipboard operation
biojupies-plugins copied to clipboard

Private key exposed!

Open GeoffSCollins opened this issue 3 years ago • 0 comments

It looks like a private key for plotly is hard coded in biojupies-plugins/library/core_scripts/shared/shared.py on line 43. Below is the following line of code:

py.sign_in('denis-torre', '1w2EWVWYx2Wjo9MMdKpf')

This should be converted to an environment variable and accessed on server machine. More information on this process can be found at this stack overflow reference. Then, no one can use this private key for their own use! I also recommend getting a new private key from plotly.

I am not super familiar with plotly, but you may not need to sign in at all when plotting offline. So, it could be as simple of a fix as deleting that one line of code!

Keep up the great work with this project!

GeoffSCollins avatar Mar 24 '21 17:03 GeoffSCollins