NP_GITHUB_TOKEN
should only be supplied as credentials for GitHub-hosted repositories
#195
Labels
NP_GITHUB_TOKEN
should only be supplied as credentials for GitHub-hosted repositories
#195
Describe the bug
A GitHub personal access token can be supplied to Nosey Parker via the
NP_GITHUB_TOKEN
environment variable. If a token is supplied, it is used for (a) GitHub REST API calls for repository enumeration (e.g.,scan --github-org=octocat
) and (b) credentials for thegit clone
operation if prompted by the remote server.The problem is with (b): the personal access token is supplied to any remote, even non-GitHub-hosted ones, like https://example.com/some-git-repo.git.
To Reproduce
If https://example.com/some-git-repo.git is configured to ask for credentials,
noseyparker
will supply<your token>
to the server.Expected behavior
NP_GITHUB_TOKEN
should only be supplied as a credential to GitHub-hosted repositories.Output of
noseyparker --version
The text was updated successfully, but these errors were encountered: