deploy.sh exposes server IP address in public repo #1

New issue

Open

opened 2026-05-25 04:03:59 -04:00 by everestmcarthur · 0 comments

everestmcarthur commented

2026-05-25 04:03:59 -04:00

(Migrated from github.com)

Server IP Disclosed in Public Repository

deploy.sh contains a comment with the server's public IP address:

# Run on the server (20.84.125.247) to deploy landing page + blog

Risk

Publicly exposing the production server IP makes it easier for attackers to:

Directly target the server with port scans or exploits
Bypass any CDN/proxy protections
Associate the IP with specific services running on it

Recommended Fix

Remove the IP from the comment, or replace with a generic placeholder:

# Run on your server to deploy landing page + blog
# Usage: curl -sL https://raw.githubusercontent.com/everestmcarthur/forge-site/main/deploy.sh | bash

Also note: the curl | bash pattern itself carries inherent risk — consider adding an integrity check (e.g. SHA256 verification) or using a signed release artifact instead.

Note: Even though the IP is now in git history, removing it from the current file reduces ongoing exposure. Consider rotating/firewalling if this IP is sensitive.

## Server IP Disclosed in Public Repository `deploy.sh` contains a comment with the server's public IP address: ```bash # Run on the server (20.84.125.247) to deploy landing page + blog ``` ## Risk Publicly exposing the production server IP makes it easier for attackers to: - Directly target the server with port scans or exploits - Bypass any CDN/proxy protections - Associate the IP with specific services running on it ## Recommended Fix Remove the IP from the comment, or replace with a generic placeholder: ```bash # Run on your server to deploy landing page + blog # Usage: curl -sL https://raw.githubusercontent.com/everestmcarthur/forge-site/main/deploy.sh | bash ``` Also note: the `curl | bash` pattern itself carries inherent risk — consider adding an integrity check (e.g. SHA256 verification) or using a signed release artifact instead. > **Note:** Even though the IP is now in git history, removing it from the current file reduces ongoing exposure. Consider rotating/firewalling if this IP is sensitive.