1.2 KiB
Token bake warning
Tag v0.2.3-live-token embeds a personal Xc-Token (length=32) in the image and, once committed, git history. This is a security risk.
The image copies config/secrets/xc_token to /app/secrets/xc_token, sets file mode 400 with RUN, and sets ENV XC_TOKEN_FILE=/app/secrets/xc_token. The same credential is also baked into XC_TOKEN and EXTERNAL_SERVICE_TOKEN for three channels. Resolution order is XC_TOKEN_FILE → XC_TOKEN → MODELHUB_XC_TOKEN → EXTERNAL_SERVICE_TOKEN.
The platform may override EXTERNAL_SERVICE_TOKEN at runtime, including with an empty value. The file is checked first so this override cannot wipe the file channel. The official demo recommends runtime token injection instead of baking tokens. This requested bake is an explicit exception. Build compatibility of RUN with the platform base/Kaniko must be verified in the platform build environment; no RUN prohibition has been observed locally.
Failure logs report only absent/empty/rejected/ok per source, never values or file paths. Successful resolution logs only the source name.
Set ALLOW_LIVE_SUBMIT=0 to stop live submissions. Rotate the token if the repository or image is exposed.