Skill's app ID: Secure to include in public repository?

user_561423 0
Viewed 156

I am developing an Alexa Skill with Skill Kit SDK, and now I prepare to publish my Skill's repository on Github. During development I included my Skill's app ID in the according index.js file and diligently committed my work with my local git.

Is there a risk involved in publishing my Skill's repository with my actual app ID? I could imagine that a malicious party might use the app ID (together with the ARN of my Skill's Lambda function) to send lots of requests and thus incur costs on AWS, but maybe there are other risks.

It seems to be good practice not to include the app ID in the public repository, since no example Skill of the official Amazon Alexa organization has their respective app ID included.

alexa-skill alexa-skills-kit amazon-web-services github security
2 Answers

Commonly, people put these keys/secrets in as an environmental variable and in the code write process.env.SKILL_KIT_KEY to retrieve it.

I would strongly recommend, if you make the switch, to deactivate the key you've used and that lives in plain-text in the repo's history and obtain a new one.

user_69166970

Another approach is to include a configuration file that contains all login or password information. You might name this file config.js. Then exclude this file from being checked into Git by listing it in the .gitignore file.

To help others to recreate this file with their own information, provide a well commented template version of this file in the project. Append "Template" to the name (eg. config_template.js) with instructions to rename it to config.js after editing it to include all their own information.

user_29414600
Related