Endevor B4G: how to avoid password exposure in application.yml

Products

• Endevor

Issue/Introduction

Visible password such as key-store-password in Bridge for Git application.yml can cause vulnerability, how to fix this issue ? 

Environment

Release : 18.1

Endevor Bridge for Git: 2.0.12

Resolution

Create environment variable, and set password as the value to this environment variable. 

For example - to avoid key-store-password exposure, create environment variable called KEYSTORE_PASS

SET KEYSTORE_PASS=******

In application.yml

ssl:   
   key-store-type: PKCS12
   key-store: C:\Users\User123\Path\to\key\store
   key-store-password: $KEYSTORE_PASS
   key-alias: # KStoreAli