T09 · Insecure Skill Coding Practices
Error
- Location
src/discord_cli/auth.py:93- Finding
Discord User Token Stored in an Unprotected Plaintext .env File
- Content
View full analysis
Path: """Save token to .env file.""" if env_path is None: env_path = Path.cwd() / ".env" lines = [] token_found = False if env_path.exists(): for line in env_path.read_text().splitlines(): if line.startswith("DISCORD_TOKEN="): lines.append(f"DISCORD_TOKEN={token}") token_found = True else: lines.append(line) if not token_found: lines.append(f"DISCORD_TOKEN={token}") env_path.write_text("\n".join(lines) + "\n") return env_path ``` The credential is obtained by scanning browser and Discord storage: ```python def find_tokens() -> list[dict]: """Scan known browser/Discord client paths for tokens. Returns list of {source, token} dicts, deduplicated by token. """ search_paths = _get_search_paths() found: dict[str, str] = {} # token -> source for source_name, db_path in search_paths: if not db_path.is_dir(): continue # Scan .ldb and .log files for ext in ("*.ldb", "*.log"): for filepath in db_path.glob(ext): for token in _extract_tokens_from_file(filepath): if token not in found: found[token] = source_name return [{"source": source, "token": token} for token, source in found.items()] ``` ### Technical Analysis The `auth` command deliberately searches multiple Discord and browser profiles for reusable Discord user tokens. When the user supplies `--save`, the selected token is written d ...[truncated 2242 chars]- Remediation
View remediation