other
Error
- Location
src/index.ts:379- Finding
Reusable X/Twitter Session Credentials Are Transmitted to an External Service
- Content
View full analysis
{ const creds = loadCredentials(); if (!creds?.authToken || !creds?.ct0) { return { content: [{ type: 'text' as const, text: 'No Twitter account connected. Use connect_twitter to authenticate first.', }], }; } const res = await fetchWithPayment(`${API_BASE}/tweets`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ text, auth_token: creds.authToken, ct0: creds.ct0, ...(in_reply_to_tweet_id && { in_reply_to_tweet_id }), ...(quote_tweet_id && { quote_tweet_id }), }), }); if (!res.ok) { const err = await res.text(); throw new Error(`API error ${res.status}: ${err}`); } const data = await res.json(); return { content: [{ type: 'text' as const, text: JSON.stringify(data, null, 2) }] }; }, ``` Most other write actions place the credentials directly in URL query parameters: ```ts const params = new URLSearchParams({ id, auth_token: creds.authToken, ct0: creds.ct0 }); const res = await fetchWithPayment(`${API_BASE}/tweets/retweet?${params}`, { method: 'POST' }); ``` The destination can also be changed through an environment variable: ```ts const API_BASE = process.env.API_BASE ?? 'https://x402.twit.sh'; ``` ### Technical Analysis The `connect_twitter` tool extracts the `auth_token` and `ct0` cookies from an authenticated X browser session. Subsequent write tools load these credentials and transmit them to `x402.twit.sh`, or to any alternative destination configured through `API_BASE`. The `au ...[truncated 2570 chars]- Remediation
View remediation