Exposed AWS Access and Secret Keys about nylas-mail HOT 2 CLOSED

Hey @mbilker thanks for pointing this out (and not trying to use them for anything malicious.) We're aware that they're included in the source and in the distributed versions of the app. Those credentials only give the client the ability to upload to that specific bucket, and not list contents or fetch files. The logs uploaded to that bucket are fed into Logstash, which allows us to monitor SQLite query performance and generate other aggregate metrics. It helps us identify performance regressions and things we can't see during development.

I don't think this is a security issue, but we should do more to make sure that sensitive data is never included in these logs, and we may need to remove the credentials from the app to prevent Amazon from automatically considering them compromised. Stay tuned—

from nylas-mail.

Thank you very much for the update. I only noticed it because its the only non-bundled source file I found.

from nylas-mail.