Files
obscura/crates
SGavrl f5d7e11692 fix(cli): pass worker proxy via env, not argv (credential leak) (#370)
obscura serve --workers N --proxy ... spawned each worker with the proxy
as a --proxy CLI flag, so the plaintext credential was visible to any
local user via ps / /proc/<pid>/cmdline (issue #366). scrape already
avoids this by passing the proxy in OBSCURA_PROXY, which is only readable
by the owner.

Pass the proxy to serve workers via OBSCURA_PROXY too, and have the serve
command read that env as a fallback when no --proxy flag is given. The
worker argv no longer contains the credential.

Fixes #366.
2026-07-09 10:52:06 +02:00
..