How to not have security violation in handling of S3 AWS keys?

Open invictus2010 opened this issue 4 years ago • 1 comments

The default installation guide for notea has the user put their AWS keys in the .env file, host it on Github, and then deploy to Vercel.

This is a huge security violation since the .env file can be read, leaving the account subsequently pwned.

Am I missing something? I very well could be, since I'm a newbie at hosting things like this.

Sep 21 '21 19:09 invictus2010

.env just tells which environment variables to configure. If you need to deploy to vercel, then you should configure these variables on the vercel dashboard.

Sep 22 '21 00:09 QingWei-Li