T09 · Insecure Skill Coding Practices
Error
- Location
- apex-ia-trader.mjs:14
- Finding
- Hard-Coded Binance API Credentials Exposed in Source Code<![CDATA[ ## Vulnerability Details **File Location**: - `apex-ia-aggressive.mjs:13-14` - `apex-ia-final-20x.mjs:53-54` - `apex-ia-final.mjs:13-14` - `apex-ia-robot.mjs:13-14` - `apex-ia-smc.mjs:53-54` - `apex-ia-trader.mjs:14-15` - `apex-ia-all.mjs:13` contains the same API key and a placeholder secret on line 14. **Vulnerability Type**: Hard-coded authentication credentials **Risk Level**: High ### Vulnerable Code The following credential declarations appear repeatedly in the listed trading programs: ```js const API_KEY = 'Dq0vl5xeDxwQKMBwoJT5A9yxsJiW8hbXyVO7831c4xbI0N1tfiQjsTf1ZKsSVIXL'; const API_SECRET = '1kVF6XZuV5rVnKyIiAjbLTNcN50tQZEI8M5p90piOblTOl4W19rpgIeZMRzDlBBb'; ``` The credentials are actively used to sign and authenticate Binance requests in `apex-ia-trader.mjs:35-62`: ```js function generateSignature(queryString, secret) { return crypto.createHmac('sha256', secret).update(queryString).digest('hex'); } async function binanceRequest(method, endpoint, params = {}, signed = false) { const timestamp = Date.now(); let queryString = `timestamp=${timestamp}`; if (Object.keys(params).length > 0) { queryString += `&${new URLSearchParams(params).toString()}`; } let signature = ''; if (signed) { signature = generateSignature(queryString, API_SECRET); queryString += `&signature=${signature}`; } const url = `${BASE_URL}${endpoint}?${queryString}`; try { const response = await axios({ method, url, headers: { 'X-MBX-APIKEY': API_KEY, 'Content-Type': 'application/json' } }); return response.data; } catch (err) { console.error(`❌ Erro na requisição: ${err.message}`); return null; } } ``` ### Technical Analysis API credentials embedded in distributed source code must be considered compromised. Any person who can download the package, inspect its repo ...[truncated 1898 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Revoke the exposed API key and secret immediately; removal from the current source tree does not invalidate copies in package archives or repository history. 2. Generate separate, user-specific credentials rather than distributing a shared credential. 3. Read credentials from a protected secret manager or environment variables: ```js const API_KEY = process.env.BINANCE_API_KEY; const API_SECRET = process.env.BINANCE_API_SECRET; if (!API_KEY || !API_SECRET) { throw new Error('Binance credentials are not configured'); } ``` 4. Ensure `.env` files, local configuration files, logs, and credential exports are excluded from version control and release archives. 5. Apply least privilege: enable only the minimum futures-trading permissions required and disable withdrawals. 6. Configure Binance IP allowlisting where operationally possible. 7. Use distinct credentials for testnet and production, with production trading disabled by default. 8. Add automated secret scanning to CI and pre-commit workflows. 9. Review repository and package history for previous credential exposure and rotate every exposed credential rather than merely deleting its current declaration. ]]>