Private Key Is Exposed in the Deployment and Upgrade Script
In the contract deploying and upgrading script, private key is used to broadcast the transaction, this would expose private key of the deployer and upgrader account on the machine running the script, therefore compromising these accounts.\\n```\\nuint256 deployerPrivateKey = vm.envUint("PRIVATE\\_KEY");\\n```\\n\\n```\\nuint256 deployerPrivateKey = vm.envUint("PRIVATE\\_KEY");\\nvm.startBroadcast(deployerPrivateKey);\\n```\\n
Have Forge sending a raw transaction to the cold wallet of the account, the wallet signs the transaction then return the signed transactions to Forge and broadcaster. Alternatively use different wallet for deployment and upgrade and stop using the wallet after the script is complete
```\\nuint256 deployerPrivateKey = vm.envUint("PRIVATE\\_KEY");\\n```\\n