Security and Operational Risks Due to Hardcoded Default Values in Configuration

[pand-app]

Hello,

First, thanks for your job.

I've noticed that your NestJS backend configurations for authentication and storage, specifically in the files auth.config.ts and storage.ts within the develop branch, utilize hardcoded default values. This practice introduces several potential risks and limitations that could affect the security of deployments.

Hardcoded defaults, especially for authentication configurations, can pose significant security risks. If a deployment leave default values, it could be easily exploited by malicious actors.

If you don't have time to solve, but agreed about this fact, we can submit a PR, just say if you've a prefered approach.

[tea-artist]

Thank you for your advice. It does have some potential risks we're working on it

[pand-app]

👍 FYI, we're working on a simple helm chart, where we're defining generating values in chart directly.

[tea-artist]

That is awesome! I think we can do this together. you can submit a PR here.