Correct two documented claims about the Web3Forms key - #8
Merged
Conversation
Both files described the key more protectively than the facts support, and one of them was simply untrue. .env.example claimed the key was "kept out of the repo so this public repository does not ship a ready-made endpoint for anyone to post to". An earlier commit in this repository's history contains a real key, so that statement was false at the time it was written. It now says what is actually true: the value is publishable, it is readable from the deployed site by anyone viewing source, keeping it out of the source tree is hygiene rather than confidentiality, and one commit in history contains a real one. It also now records that the value is inlined at build time, so changing it in hosting does nothing to an existing deployment without a redeploy. That behaviour cost real time to rediscover. SECURITY.md presented the Web3Forms domain restriction as though it settled the question. It is enforced on a request header, which any client can set, so it raises effort rather than preventing abuse. The wording no longer implies otherwise, and the invitation to report abuse now explicitly includes getting past that restriction. A documented control that does not hold is worse than no claim at all, particularly in a repository published to demonstrate practice.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #6. Both files described the access key more protectively than the facts support, and one was simply untrue.
.env.exampleClaimed the key was "kept out of the repo so this public repository does not ship a ready-made endpoint for anyone to post to".
An earlier commit in this repository's history contains a real key, so that was false at the time it was written. A documented control that does not hold is worse than no claim at all, particularly here.
Now states what is true: the value is publishable rather than secret, it is readable from the deployed site by anyone viewing source, keeping it out of the source tree is hygiene rather than confidentiality, and one commit in history contains a real one.
Also records that the value is inlined at build time, so changing it in hosting does nothing to a deployment that already exists without a redeploy. That behaviour cost real time to rediscover and is worth writing down where the next person will look.
SECURITY.mdPresented the Web3Forms domain restriction as though it settled the question. It is enforced on a request header, which any client can set, so it raises the effort required rather than preventing abuse.
The wording no longer implies otherwise, and the invitation to report abuse now explicitly includes getting past that restriction, which is the more useful thing to ask for.
Verification
Lint, 155 tests and the production build all pass. Documentation only, no behaviour change.
Generated by Claude Code