Cybersecurity-Projects/PROJECTS/intermediate/docker-security-audit/tests/testdata/compose/bad-secrets.yml

47 lines
1.3 KiB
YAML

version: '3.8'
services:
api:
image: node:18
environment:
# CRITICAL: AWS credentials
- AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
- AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
# CRITICAL: Database with password
- DATABASE_URL=postgresql://admin:SuperSecret123@db.example.com:5432/prod
- MONGODB_URI=mongodb://root:MongoPass456@mongo:27017/app?authSource=admin
# CRITICAL: API keys
- STRIPE_SECRET_KEY=sk_live_51AbCdEfGhIjKlMnOpQrStUvWxYz
- GITHUB_TOKEN=ghp_1234567890abcdefghijklmnopqrstuvwxyz123
- OPENAI_API_KEY=sk-proj-AbCdEfGhIjKlMnOpQrStUvWxYz1234567890
# HIGH: Sensitive keys
- JWT_SECRET=my-super-secret-jwt-key-12345
- SESSION_SECRET=session-secret-key-67890
- API_KEY=my-api-key-abcdef
- PASSWORD=admin123
# CRITICAL: Private keys
- PRIVATE_KEY=-----BEGIN RSA PRIVATE KEY-----
# HIGH: Cloud provider credentials
- GOOGLE_API_KEY=AIzaSyAbCdEfGhIjKlMnOpQrStUvWxYz12345
- AZURE_CLIENT_SECRET=AbC~dEf1234567890GhIjKlMnOpQrStUvWxY
ports:
- "3000:3000"
command: npm start
db:
image: postgres:15
environment:
# CRITICAL: Database passwords in plaintext
- POSTGRES_PASSWORD=SuperSecretDatabasePassword123!
- POSTGRES_USER=admin
# MEDIUM: No resource limits