T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/fmp_client.py:33- Finding
FMP API Key Exposed Through Process Arguments and URL Query Parameters
- Content
View full analysis
Optional[dict]: if self.rate_limit_reached: return None if params is None: params = {} params["apikey"] = self.api_key elapsed = time.time() - self.last_call_time if elapsed < self.RATE_LIMIT_DELAY: time.sleep(self.RATE_LIMIT_DELAY - elapsed) try: response = self.session.get(url, params=params, timeout=30) ``` ### Technical Analysis The documented invocation expands `FMP_API_KEY` into the process argument vector. Depending on the operating system and monitoring configuration, command-line arguments can be exposed through process-listing utilities, `/proc` interfaces, shell history, job schedulers, audit systems, or observability agents. The HTTP client also places the API key in the `apikey` URL query parameter. TLS protects the request while it is transmitted over the network, but query strings are commonly recorded in application logs, reverse-proxy logs, API gateway telemetry, HTTP debugging output, and server-side access logs. This inc ...[truncated 1455 chars]- Remediation
View remediation