Glovo: Exposed valid AWS, Mysql, Sendgrid and other secrets

Summary: Hi team, I just discovered some hardcoded credentials allowing access to AWS, Mysql database, ... To make this report short, here is the POC: see F1743107 & F1743108 Steps To Reproduce: where there are the info : APP_NAME=Glovo APP_ENV=local APP_KEY=base64:F1Z3wcFDFuQdgU/H570v2C6aRm8hfd1Ojgpwow45ti0= APP_DEBUG=false APP_URL=http://localhost LOG_CHANNEL=stack LOG_LEVEL=debug DB_CONNECTION=mysql DB_HOST=glovo-receipt.cnhgmvsolizy.eu-central-1.rds.amazonaws.com DB_PORT=3306 DB_DATABASE=glovo_receipt DB_USERNAME=admin DB_PASSWORD=3b2!T54x6 BROADCAST_DRIVER=log CACHE_DRIVER=file QUEUE_CONNECTION=sync SESSION_DRIVER=file SESSION_LIFETIME=120 MEMCACHED_HOST=127.0.0.1 REDIS_HOST=redis-11773.c6.eu-west-mz.1.ec2.cloud.redislabs.com REDIS_PASSWORD=oGepFo4BMIC9AFbRzGKdM8HqapRVKqvF REDIS_PORT=11773 MAIL_MAILER=smtp MAIL_HOST=mailhog MAIL_PORT=1025 MAIL_USERNAME=null MAIL_PASSWORD=null MAIL_ENCRYPTION=null MAIL_FROM_ADDRESS=null MAIL_FROM_NAME="${APP_NAME}" AWS_ACCESS_KEY_ID=AKIAV2DLOALF7J6IQSTE AWS_SECRET_ACCESS_KEY=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 AWS_DEFAULT_REGION=eu-central-1 AWS_BUCKET=glovos3 PUSHER_APP_ID= PUSHER_APP_KEY= PUSHER_APP_SECRET= PUSHER_APP_CLUSTER=mt1 MIX_PUSHER_APP_KEY="${PUSHER_APP_KEY}" MIX_PUSHER_APP_CLUSTER="${PUSHER_APP_CLUSTER}" SENDGRID_API_KEY=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 [email protected] [email protected]...