nuxt
“Nuxt full-stack Vue framework with SSR, auto-imports, and file-based routing. Use when working with Nuxt apps, server routes, useFetch, middleware, or hybrid rendering.”
references
aipkg.jsonGENERATION.mdLICENSE.txtREADME.mdreferences/advanced-hooks.mdreferences/advanced-layers.mdreferences/advanced-module-authoring.mdreferences/best-practices-data-fetching.mdreferences/best-practices-ssr.mdreferences/core-cli.mdreferences/core-config.mdreferences/core-data-fetching.mdreferences/core-deployment.mdreferences/core-directory-structure.mdreferences/core-modules.mdreferences/core-routing.mdreferences/features-components-autoimport.mdreferences/features-components.mdreferences/features-composables.mdreferences/features-server.mdreferences/features-state.mdreferences/rendering-modes.mdSKILL.md- 01SQP-285%MEDIUM
references/core-deployment.md:164
detailhide
The rsync deployment example shows credentials being passed directly in a GitHub Actions workflow without any guidance on secret management. An attacker who gains access to the repository, GitHub Actions logs, or workflow files could extract the `user@server` credentials. This is especially dangerous because the example uses plaintext SSH credentials in a publicly visible CI/CD configuration without explaining the proper use of GitHub Secrets.
162 - run: npm run build163164 # Deploy to your server (example: rsync to VPS)165 - name: Deploy to server166 run: rsync -avz .output/ user@server:/app/fix Update the example to use GitHub Secrets for credentials: replace `user@server` with `${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}`. Add explicit documentation advising users to: (1) Store credentials in GitHub Secrets, never hardcode them; (2) Use SSH keys with passphrases or certificate-based authentication; (3) Implement repository protection rules to require approvals for sensitive workflows; (4) Regularly rotate deployment credentials.