[ThalesX]

I did a similar thing as part of a "lunch and learn". NodeJS + Express was super fresh and I did a small example app. When returning the user profile, I just queried the database and returned the entry displaying some properties on the frontend.

The team lead was like "show us the request in the console", and I opened it up and there was the non-encrypted password, createdAt date and basically all the not-needed properties.

I still cringe thinking about it.

[ranting-moth]

No need to cringe, this is exactly what demos are. A hack to demonstrate functionality.

[mikestew]

I still cringe thinking about it.

Meh, as a sibling comment points out, it's a demo, it'll happen. And when it happens, it's a teachable moment (assuming you can keep your head together as your demo falls apart before your very eyes): "Ah, so as you can see it's import to set the $DO_NOT_DISPLAY_PLAIN_TEXT_CREDS environment var to 'true', otherwise you get this disaster! Hahaha...ha."

Or if you don't know at the time what's going on, "obviously I'm just getting started on this myself, and need to play with some configuration. Better make sure I do before any of this goes to production! Hahaha...ha."

[chasd00]

hah what i did involved a db too, a string based query without sanitization introducing a possible sql injection. The input never came from a user and was sourced from a config file but i still should have known better. I learned that if you put it in a slide, no matter scope/purpose, it better be production quality because people are just going to copy/paste.

[catchnear4321]

copy/paste/“improve”

the only thing scarier than seeing your personal “not for prod” code running in prod by someone else’s hand. the “improvements.”

[l33t7332273]

I don’t think that’s so bad. It’s a demo, not an end product.