I remember when a senior developer where i worked was tired of connecting to the servers to check its configuration, so they added a public facing rest endpoint that just dumped the entire active config, including credentials and secrets

That was a smaller slip-up than exposing a database like that (he just forgot that the config contained secrets) but still funny that it happened

[–] PattyMcB@lemmy.world 2 points 3 weeks ago (1 children)

That's not a "senior developer." That's a developer that has just been around for too long.

Secrets shouldn't be in configurations, and developers shouldn't be mucking around in production, nor with production data.

[–] ignotum@lemmy.world 1 points 3 weeks ago

Yeah the whole config thing in that project was an eldritch horror of a legacy, too ingrained in both the services and tooling to be modified without massive rewrites