Make test databases obvious that they're test databases
We received 3 reports of publicly accessible databases today, all referencing databases found in https://github.com/plotly/falcon-sql-client/blob/master/sample-storage/connections.yaml . I'm not sure why this is happening today but I suspect we've been indexed by a vulnerability search engine.
In order to stop people from reporting this issue, I've added it to our policy and scope document but not everyone will read that. Therefore I suggest doing all these things if possible:
- [x] Add a comment to
connections.yamlnoting that these are all test databases that are intentionally public (see PR #232). - [x] ~~Buy a "plotly testing" domain and~~ Add all these sites to the
test.plotly.hostdomain rather than using the default AWS DNS entries. ~~(Please don't add them toplot.lysince that actually is a security risk.)~~ - [ ] Change table names and/or column names to include "testing"
- [ ] If the site has a configurable header, add "Testing" to the header
@tarzzz @chriddyp Can someone please deal with this soon?
We now own plotly.host, including test.plotly.host. DNS entries for the databases could be added under there.
Re #335 #336