Currently, the outsystemscc CLI utility expects authentication tokens to be provided directly via command-line arguments (e.g., using the --header "token: <TOKEN_VALUE>" flag).
While functional, passing sensitive credentials directly as command-line arguments means they are visible in the operating system's process table. In multi-user environments, automated CI/CD runners, or systems with active audit logging, this can inadvertently expose active gateway tokens to unauthorized local users or log aggregators.
Proposed Solution / Feature Request
To improve the tool's hardening posture and support secret-handling best practices, it would be highly beneficial to add support for alternative token delivery methods:
- Environment Variables: Allow
outsystemscc to pull the token or headers from a dedicated environment variable (e.g., OUTSYSTEMSCC_TOKEN). Environment variables are isolated to the process context and are not globally visible via standard process listings.
- Configuration or Token File: Provide a flag to read the token from a file with restricted file permissions (e.g.,
--token-file /path/to/secret.txt).
- Standard Input (stdin): Provide a mechanism to safely pipe the token into the command upon startup.
Currently, the
outsystemsccCLI utility expects authentication tokens to be provided directly via command-line arguments (e.g., using the--header "token: <TOKEN_VALUE>"flag).While functional, passing sensitive credentials directly as command-line arguments means they are visible in the operating system's process table. In multi-user environments, automated CI/CD runners, or systems with active audit logging, this can inadvertently expose active gateway tokens to unauthorized local users or log aggregators.
Proposed Solution / Feature Request
To improve the tool's hardening posture and support secret-handling best practices, it would be highly beneficial to add support for alternative token delivery methods:
outsystemsccto pull the token or headers from a dedicated environment variable (e.g.,OUTSYSTEMSCC_TOKEN). Environment variables are isolated to the process context and are not globally visible via standard process listings.--token-file /path/to/secret.txt).