[HIGH] Hardcoded cryptographic keys in Hudu example secrets #17

New issue

Open

opened 2026-05-05 15:44:08 -05:00 by pjennings · 0 comments

pjennings commented

2026-05-05 15:44:08 -05:00

Owner

Labels: area:security, area:containers, priority:high, type:bug

Description

In modules/secrets.example/apps1.nix, the Hudu configuration contains what appear to be real cryptographic values:

SECRET_KEY_BASE (64 hex chars)
PASSWORD_KEY (32 hex chars)
TWO_FACTOR_KEY (32 hex chars)

These have proper hex format suggesting they may be real production values.

Impact

If real: SECRET_KEY_BASE enables session forgery, PASSWORD_KEY enables password decryption, TWO_FACTOR_KEY enables 2FA bypass.

Recommended Fix

IMMEDIATELY rotate all three keys if they are real values
Replace with obvious placeholders
Move to encrypted secrets management

**Labels:** area:security, area:containers, priority:high, type:bug ## Description In modules/secrets.example/apps1.nix, the Hudu configuration contains what appear to be real cryptographic values: - SECRET_KEY_BASE (64 hex chars) - PASSWORD_KEY (32 hex chars) - TWO_FACTOR_KEY (32 hex chars) These have proper hex format suggesting they may be real production values. ## Impact If real: SECRET_KEY_BASE enables session forgery, PASSWORD_KEY enables password decryption, TWO_FACTOR_KEY enables 2FA bypass. ## Recommended Fix 1. IMMEDIATELY rotate all three keys if they are real values 2. Replace with obvious placeholders 3. Move to encrypted secrets management