T09 · Insecure Skill Coding Practices
Warning
- Location
credentials.json:1- Finding
Plaintext Credential Storage in a Project-Local JSON File
- Content
View full analysis
Vulnerability Details
File Location:
credentials.json:1-4
Related Locations:scan.py:77-93,SKILL.md:20-31
Vulnerability Type: Plaintext sensitive-data storage
Risk Level: MediumVulnerable Code
credentials.json:1-4:json { "email": "deine-email@beispiel.de", "password": "dein-passwort" }scan.py:77-93:python def load_credentials(): """Laedt Zugangsdaten aus credentials.json.""" creds_path = Path(__file__).parent / "credentials.json" if not creds_path.exists(): print("Fehler: credentials.json nicht gefunden.", file=sys.stderr) print("Kopiere credentials.example.json -> credentials.json und trage deine Daten ein.", file=sys.stderr) return None with open(creds_path) as f: creds = json.load(f) if not creds.get("email") or not creds.get("password"): print("Fehler: email oder password in credentials.json ist leer.", file=sys.stderr) return None return credsSKILL.md:20-31:markdown ### 2. Zugangsdaten Trage deine USC-Logindaten ein: ```json { "email": "deine-email@beispiel.de", "password": "dein-passwort" }Die Datei
credentials.jsonist in.gitignoreund wird nicht committet. Zugangsdaten werden nur fuer--book,--cancelund--bookingsbenoetigt.text ### Technical Analysis The application instructs users to place an account password in a plaintext JSON file located directly inside the project directory. The credential loader then reads this file without checking its ownership or permissions. Although the audited file contains placeholder values rather than an exposed real password, it is intended to be overwritten with live credentials. The documentation claims that `credentials.json` is excluded through `.gitignore`, but no `.gitignore` file exists in the audited project directory. Moreover, because `credentials.json` is already present in the artifact, adding an ignore rule later would not protect it ...[truncated 1699 chars]- Remediation
View remediation
Remediation Suggestions
- Remove
credentials.jsonfrom the distributed project and version-control history. - Distribute only a clearly non-secret template such as
credentials.example.json. - Add
/credentials.jsonto a project-root.gitignorebefore users create the real file. - If the file has previously been tracked, remove it from the index and purge any real credentials from repository history.
- Prefer an operating-system credential manager, secret-management service, or narrowly scoped environment variables over a project-local plaintext file.
- If file-based storage must remain:
- Store the file outside the source tree.
- Require owner-only permissions, such as mode
0600on supported systems. - Validate ownership and permissions before reading it.
- Refuse documented placeholder values.
- Add automated secret scanning and a test that fails if
credentials.jsonis packaged or tracked. - Rotate any real credentials that may already have been committed, uploaded, backed up, or shared.
- Remove