Ganache using some vulnerable library #3927
Replies: 3 comments 2 replies
-
|
Can you prove it? |
Beta Was this translation helpful? Give feedback.
-
|
Let me do that. I am trying to trace back the transactions. I think i have located the real account linked with the destination account.
In the meantime, do not use real secret on ganache.
This was the only place i used my real secret.
Sagar Khatri
On Nov 18, 2022, at 8:56 AM, David Murdoch ***@***.***> wrote:
Can you prove it?
—
Reply to this email directly, view it on GitHub<#3927 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AETWAYQJBGFXIKMSCOG7P6DWI6KJ5ANCNFSM6AAAAAASESMSJA>.
You are receiving this because you authored the thread.Message ID: ***@***.***>
|
Beta Was this translation helpful? Give feedback.
-
|
Please email SecOps@consensys.net if you discover an issue. Please disclose responsibly. |
Beta Was this translation helpful? Give feedback.
-
|
+ ***@***.******@***.***>
is the ganache application code being reviewed security wise.i.e code scan, manual vertification of all third party dependencies and probably outbound traffic scan.
If this is happening, then it should be good enough.
if there is an issue, it needs to be addressed.
Sagar Khatri
On Nov 18, 2022, at 10:05 AM, David Murdoch ***@***.***> wrote:
l ***@***.******@***.***>
|
Beta Was this translation helpful? Give feedback.
-
|
It is scanned regularly and dependencies are manually verified. We don't monitor outbound traffic. You do know Ganache isn't a secure wallet or password manager, right? |
Beta Was this translation helpful? Give feedback.
-
I feel ganache has some security vulnerabilities. Any data that ganache uses locally should not be exploited or exported over.
Beta Was this translation helpful? Give feedback.
All reactions