dotenv-vault icon indicating copy to clipboard operation
dotenv-vault copied to clipboard

Add machine scoping to `login`

Open motdotla opened this issue 3 years ago • 0 comments

Currently the login command generates a .env.me credential per vault/login permutation. This is great and is a default security mechanism that goes a step further than typical - including GitHub, Heroku, AWS, etc..

That said, if somehow the .env.me was accidentally shared an attacker could potentially access environment variables for just that project. Add a mechanism to additionally scope that .env.me to the user's machine. This way if another machine was attempting to make use of the .env.me it would not work.. and you would be warned.

motdotla avatar Jun 24 '22 22:06 motdotla