Hello, We're getting a report from HackerOne that our permanent Prismic API token is included in our app.js file. On our side, we use environment variables to store this value safely, but the gatsby-source-prismic plugin seems to include it anyway. Is it safe to display this value publicly? Accor…

Hey Nicolas, thanks for reaching out! This is still an open discussion about the community built plugin; there's a Github thread that details a similar case and the workarounds that Angelo, the plugin creator, recommends. Please refer to this link to read the full conversation . Thanks

Hey @nicolas.spehler ! I would like to add that the upcoming version 4 of the gatsby-soure-prismic plugin will introduce some changes in that area. Here you have the general Github discussion. Here you have a more detailed outlook, that also describes the changes regarding the exposed token.

Permanent access token included in app.js source code

Developing with Prismic

Topic		Replies	Views
Permanent Access token Developing with Prismic rest-api	1	1844	June 4, 2021
How protect my token in the browser inspector on Prismic-Ref calls? Developing with Prismic graphql	1	669	November 29, 2021
Permanent access tokens - Public? Developing with Prismic graphql	1	933	September 23, 2020
Gatsby-source-prismic - unable to access the Prismic repository Developing with Prismic	5	1084	February 9, 2023
Unable to access the Prismic repository. Check that the correct repository name and access token are provided Developing with Prismic gatsby , env-variables-error	4	266	April 29, 2024

Permanent access token included in app.js source code

Related topics