1. Create a standard security.txt 2. Cram it into your envs far and wide. 3. Make it easier for researchers to return your lost envs to you without splashing around in prod with your creds. lostenvfound.com
lostenvfound.comLOSTENVFOUNDSet SECURITY_TXT in your .env files so researchers can return leaked credentials without using your secrets.
Friendly reminder to put a security contact email address in your env variables so when I accidentally find them online I can return them to you.
5 reposts9 likes