T09 · Insecure Skill Coding Practices
- Location
transcript_analyzer.py:46- Finding
Hard-Coded QVeris Bearer Credential
- Content
View full analysis
Vulnerability Details
File Location:
transcript_analyzer.py:46, used attranscript_analyzer.py:151
Vulnerability Type: Hard-coded API secret
Risk Level: HighVulnerable Code:
python QVERIS_API_KEY = "sk-OAk52GSBLKryEWgg-bKP4yoJyRqA6RToSYSTTND7-jg"The credential is subsequently placed in an authorization header:
python req.add_header("Authorization", f"Bearer {QVERIS_API_KEY}")Technical Analysis
A live-looking QVeris bearer token is embedded directly in the distributed source code. Anyone with access to the Skill package can retrieve the credential without executing the program.
Authentication is necessary for the declared optional API mode, but distributing a shared credential is not necessary and violates least-privilege secret-management practices. Source-level secrets cannot be meaningfully protected through repository or package access controls once the Skill is distributed.
The token is transmitted over HTTPS to the configured QVeris endpoint, so the primary issue is not transport security. The issue is disclosure and unauthorized reuse of the bearer credential. Because bearer tokens generally grant access based solely on possession, an attacker does not need an additional password or cryptographic proof.
Attack Path
- An attacker downloads or otherwise obtains the Skill package.
- The attacker reads
transcript_analyzer.pyand extracts the token from line 46. - The attacker constructs requests to the QVeris API using:
http Authorization: Bearer <extracted-token> - The attacker invokes any QVeris operations permitted by the token.
- The attacker consumes API quota, incurs associated costs, or accesses other resources available under the credential until it is revoked.
Impact Assessment
Successful exploitation grants the attacker the same QVeris API privileges assigned to the exposed token. The exact authorization sco ...[truncated 596 chars]
- Remediation
View remediation
Remediation Suggestions
- Revoke and rotate the exposed credential immediately.
- Remove the token from the source code and repository history.
- Require each user to supply a QVeris key through a protected environment variable or secret manager, for example:
python QVERIS_API_KEY = os.environ.get("QVERIS_API_KEY") if not QVERIS_API_KEY: raise RuntimeError( "QVERIS_API_KEY is required when --mode api is selected" ) - Only load the secret when API mode is selected; web mode should not require access to it.
- Avoid printing the token or including it in exceptions, generated reports, telemetry, or logs.
- Configure the replacement token with the narrowest available API scope, quota, and lifetime.
- Add automated secret scanning to the development and release process.
- If shared service access is required, use a controlled backend that authenticates individual users rather than distributing a shared bearer token.