T09 · Insecure Skill Coding Practices
Error
- Location
- config.env:1
- Finding
- Plaintext API Credential Stored in the Project## Vulnerability Details **File Location**: `config.env:1` **Vulnerability Type**: Hardcoded secret / plaintext API credential **Risk Level**: High ### Vulnerable Code ```env DEEPSEEK_API_KEY=sk-058c451313aa4510a8a42818da613fe9 ``` ### Technical Analysis The project contains a DeepSeek API key in plaintext. The application reads the key from the `DEEPSEEK_API_KEY` environment variable in `scripts/chat.js:3-4` and places it in the HTTP `Authorization` header at `scripts/chat.js:27-28`: ```javascript const API_KEY = process.env.DEEPSEEK_API_KEY; const API_URL = 'https://api.deepseek.com'; ``` ```javascript headers: { 'Authorization': `Bearer ${API_KEY}`, 'Content-Type': 'application/json', 'Content-Length': data.length } ``` Although transmitting the credential to the documented DeepSeek HTTPS endpoint is required for the advertised functionality, distributing the credential in `config.env` exposes it to anyone who can access the project package, repository, backups, build artifacts, or shared filesystem. Environment-variable usage does not protect a secret when its value is committed alongside the source code. ### Attack Path 1. An attacker obtains a copy of the project or access to its source repository, package, backup, or build artifact. 2. The attacker opens `config.env` and extracts the plaintext DeepSeek API key. 3. The attacker uses the key as a Bearer token in requests to the DeepSeek API. 4. Requests execute under the credential owner's API account until the key is revoked, expires, or is otherwise restricted. ### Impact Assessment An attacker may consume the account's API quota, incur financial charges, exhaust usage limits, and make API requests attributable to the credential owner. The precise scope is limited to the permissions and account resources granted to this key; the reviewed files do not establish broader host or system privileges.
- Remediation
- ## Remediation Suggestions 1. Immediately revoke the exposed credential and generate a replacement. Treat the current key as compromised even if unauthorized use has not yet been observed. 2. Review provider-side usage and billing logs for suspicious requests made with the exposed key. 3. Remove `config.env` from distributed packages, repository history, release artifacts, caches, and backups where feasible. 4. Add `config.env` and equivalent local secret files to `.gitignore` and packaging exclusion rules. 5. Supply the replacement key only at runtime through a secret manager, protected deployment configuration, or environment variable that is not committed to source control. 6. Provide a safe template such as `config.env.example` containing only a placeholder: ```env DEEPSEEK_API_KEY=replace-with-your-own-key ``` 7. Apply provider-supported restrictions such as spending limits, scoped permissions, expiration, and key rotation. 8. Add automated secret scanning to pre-commit hooks and CI pipelines to prevent future credential commits.