T09 · Insecure Skill Coding Practices
Error
- Location
fastgpt_client.py:34- Finding
Personal Data and API Credentials Transmitted over Unencrypted HTTP
- Content
View full analysis
bool: response = self.call( phone, variables={}, chat_id=f"{session_id}-agent-a", ) ``` ```python def save_phone(self, phone: str, session_id: str) -> bool: response = self.call( phone, variables={}, chat_id=f"{session_id}-agent-b", ) ``` Every product query sent to agent C includes the phone number and session identifier: ```python def query_product(self, question: str, session_id: str, phone: str) -> str: return self.call( question, variables={"phone": phone, "session_id": session_id}, chat_id=f"{session_id}-agent-c", ) ``` ### Technical Analysis The client transmits bearer credentials, phone numbers, session identifiers, and complete user questions through a fixed third-party endpoint using HTTP rather than HTTPS. HTTP provides neither co ...[truncated 2004 chars]- Remediation
View remediation