T09 · Insecure Skill Coding Practices
- Location
snippets/rest-client.md:12- Finding
Bearer API Key Unnecessarily Sent to the Public OpenAPI Endpoint
- Content
View full analysis
Vulnerability Details
File Location:
snippets/rest-client.md:12-20
Vulnerability Type: Unnecessary credential transmission
Risk Level: MediumVulnerable Code
ts const headers = { Authorization: `Bearer ${process.env.REMIX_API_KEY!}`, 'Content-Type': 'application/json', } const openApiSpec = await fetch(`${baseUrl}/docs/json`, { method: 'GET', headers, }).then((r) => r.json())Technical Analysis
The example creates one shared header object containing the
REMIX_API_KEYand uses it to retrieve the OpenAPI document from/docs/json. The project presents this endpoint as public documentation, so schema discovery does not require the bearer credential.Attaching the API key to an unauthenticated request violates least privilege and expands the secret's exposure surface. The credential may become visible to request logging, tracing systems, reverse proxies, middleware, or future redirect handling associated with the documentation endpoint. Although the reviewed code sends the key only to the declared first-party domain and no attacker-controlled recipient was identified, the credential is still disclosed to infrastructure that does not need it.
Attack Path
- A user stores a valid publishing credential in
REMIX_API_KEY. - An agent or developer copies the documented REST client pattern.
- The shared
headersobject inserts the credential into every illustrated request. - The client requests
https://api.remix.gg/docs/jsonwith the bearer key. - Documentation-endpoint middleware, proxies, logs, or tracing systems receive or record a credential that was not needed for the operation.
- If such infrastructure is compromised or its logs are exposed, an unauthorized party could recover and reuse the key.
No evidence in the audited project demonstrates that this infrastructure is currently compromised; the final step describes the applicable exploitation condition.
Impact Assessment
Exposure of a valid A ...[truncated 505 chars]
- A user stores a valid publishing credential in
- Remediation
View remediation
Remediation Suggestions
Use separate headers for public and authenticated requests. Fetch the OpenAPI document without an authorization header:
ts const openApiSpec = await fetch(`${baseUrl}/docs/json`, { method: 'GET', }).then((r) => r.json()) const authenticatedHeaders = { Authorization: `Bearer ${process.env.REMIX_API_KEY!}`, 'Content-Type': 'application/json', }Apply
authenticatedHeadersonly to endpoints that explicitly require authentication. Additionally:- Avoid globally shared credential-bearing header objects.
- Permit credentials only for an explicit allowlist of HTTPS origins and authenticated paths.
- Disable automatic redirects for authenticated requests, or validate that every redirect remains on the approved origin before resending credentials.
- Ensure application, proxy, and tracing systems redact
Authorizationheaders. - Rotate the API key if logs may already have captured it.
- Update
api/reference.mdto state explicitly that/docs/jsonmust be fetched without authentication.