Security Training

[alex-zaman-circle]

• missing package lockfile (package injection attack)

• should probably also hide the paymentGatewayKey and smsProviderKey behind secrets manager

• api key in logs

• schemas need identifiers to hide information, e.g., User should have userID primary key and we should use that for logging

This is not atomic and could result in loss of funds if K8 pod exists

            balances.put(from, balances.get(from) - amount);
            balances.put(to, balances.get(to) + amount);

• repo is publicly accessible. should be less permissive

• can possibly spam generateMonthlyReport to DoS

• transaction query should have authorization check