fix(security): 删除 .env.production 并清理硬编码密码 #54

2026-06-27T18:11:05+08:00

xiaoxia commented

2026-06-27 18:11:05 +08:00

安全加固修复

变更内容

删除 .env.production
- 从版本控制中移除 .env.production 文件（含占位符密钥）
- .gitignore 已包含相关规则
清理硬编码密码/密钥
- scripts/smoke_public_upload_flow.py: 密码改为从环境变量 SMOKE_TEST_PASSWORD 读取
- scripts/smoke_public_boundary_flow.py: 密码改为从环境变量读取
- scripts/smoke_public_auth_flow.py: 密码改为从环境变量读取
- infra/docker/infra.yml: POSTGRES_PASSWORD 改为引用环境变量 ${POSTGRES_PASSWORD:-changeme_in_production}
- packages/application/auth/jwt_handler.py: 文档示例中的密钥改为占位符 <YOUR_SECRET_KEY>

注意事项

部署时需确保环境变量 POSTGRES_PASSWORD 和 SMOKE_TEST_PASSWORD 已正确配置
生产环境密码应使用强随机字符串，通过安全方式注入

服务器安全扫描报告

详见 /docs/server-security-scan-report.md

## 安全加固修复 ### 变更内容 1. **删除 .env.production** - 从版本控制中移除 .env.production 文件（含占位符密钥） - .gitignore 已包含相关规则 2. **清理硬编码密码/密钥** - `scripts/smoke_public_upload_flow.py`: 密码改为从环境变量 `SMOKE_TEST_PASSWORD` 读取 - `scripts/smoke_public_boundary_flow.py`: 密码改为从环境变量读取 - `scripts/smoke_public_auth_flow.py`: 密码改为从环境变量读取 - `infra/docker/infra.yml`: `POSTGRES_PASSWORD` 改为引用环境变量 `${POSTGRES_PASSWORD:-changeme_in_production}` - `packages/application/auth/jwt_handler.py`: 文档示例中的密钥改为占位符 `<YOUR_SECRET_KEY>` ### 注意事项 - 部署时需确保环境变量 `POSTGRES_PASSWORD` 和 `SMOKE_TEST_PASSWORD` 已正确配置 - 生产环境密码应使用强随机字符串，通过安全方式注入 ### 服务器安全扫描报告详见 `/docs/server-security-scan-report.md`

xiaoxia added 1 commit 2026-06-27 18:11:05 +08:00

fix(security): 删除 .env.production 并清理硬编码密码

ci/cd Manually approved by coordinator

CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Has been cancelled

Details

CI/CD Pipeline / Frontend Lint (pull_request) Has been cancelled

Details

66bb0d87ab

- 删除 .env.production（含占位符密钥，已从版本控制移除）
- scripts/smoke_public_*.py: 密码改为从环境变量 SMOKE_TEST_PASSWORD 读取
- infra/docker/infra.yml: POSTGRES_PASSWORD 改为引用环境变量
- packages/application/auth/jwt_handler.py: 文档示例密钥改为占位符

xiaoxia merged commit 44f57a2560 into develop

2026-06-27 19:01:27 +08:00

xiaoxia referenced this issue from a commit

2026-06-27 19:01:27 +08:00

Merge PR #54: fix(security) 删除.env.production并清理硬编码密码

xiaoxia referenced this issue from a commit

2026-06-27 19:11:48 +08:00

Merge PR #54: fix(security) 删除.env.production并清理硬编码密码

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: xiaoxia/xiaoxia-saas#54