critical
suspicious.exposed_secret_literal
- Location
- dist/channel-DfEqBtUh.js:1193
- Finding
- File appears to expose a hardcoded API secret or token.
- Evidence
privateKey: [REDACTED],
Openclaw Nostr 2026.5.12 Beta.6.Tgz
AdvisoryAudited by Static analysis on May 10, 2026.
Overview
Detected: suspicious.exposed_secret_literal
Findings (4)
critical
suspicious.exposed_secret_literal
- Location
- dist/config-schema-DIk4jlBg.js:53
- Finding
- File appears to expose a hardcoded API secret or token.
- Evidence
privateKey: [REDACTED]().optional(),
critical
suspicious.exposed_secret_literal
- Location
- dist/setup-plugin-api.js:84
- Finding
- File appears to expose a hardcoded API secret or token.
- Evidence
const privateKey = [REDACTED]?.trim();
critical
suspicious.exposed_secret_literal
- Location
- dist/setup-surface-DxAaUTyC.js:88
- Finding
- File appears to expose a hardcoded API secret or token.
- Evidence
const privateKey = [REDACTED](nostrCfg?.privateKey) ?? "";