No secret has a literal fallback in code or config; the Janus API secret never goes to a browser

FixMediaService
Shipped
September 17, 2026 at 4:28 AM UTC
Author
Kamo
Commit
ff03c52

The Janus API, token and admin secrets and the TURN password were committed four times over: as @Value defaults in WebRTCController and JanusService, as defaults in the bundled and the k8s application.yml, and as literal env values in k8s/deployment.yaml. GET /api/webrtc/config also returned the Janus API secret in its response. Six more classes defaulted **************** to a known string, and the bundled application.yml defaulted the datasource password, so a missing environment variable would have meant a guessable credential instead of a failed start. Checked before removing: no Janus server answers (https://kamocrm.com:8089 times out while :443 on the same host answers; there is no Janus pod, service or ingress), and nothing in kamo-internal, the mobile app, kamo-js or kamo-meet calls /api/webrtc. coturn authenticates with use-auth-secret from its own Secret (TURN_SECRET), so the static TURN password was accepted by nothing. **************** and DB_PASSWORD are set from Secrets, and the deployment's SPRING_CONFIG_LOCATION means the bundled application.yml is never loaded in the pod. - Janus secrets and the TURN password now default to empty; token signing refuses an unconfigured secret instead of signing with an empty key, and the config response offers a TURN server only when it has credentials. - The internal-auth secret and datasource password have no default at all (${X}). - The three literal JANUS_* env entries leave deployment.yaml (kubectl apply's three-way merge removes them). - /api/webrtc/config no longer includes apiSecret. NoLiteralSecretDefaultsTest scans src/main/java, src/main/resources and k8s: a placeholder named secret, password, token, api-key or private-key may not carry a literal default, and deployment.yaml may not give such an env var an inline value. The in-pod keystore password is the one listed exception. With either rule broken it fails, and it checks that it is really reading those files. The values removed here are still in git history, so rotate them if they are used anywhere outside this service.

All changes

Like what you see shipping?

All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.

Start Free ForeverView Pricing