T09 · Insecure Skill Coding Practices
Error
- Location
scripts/volcengine_supabase/platform/aidap_client.py:27- Finding
Privileged Supabase service-role key transmitted over plaintext HTTP by default
- Content
View full analysis
Optional[str]: # ... for domain in domains: if 'volces.com' in domain and 'ivolces.com' not in domain: if ENDPOINT_SCHEME == "https": result = f"https://{domain}" else: result = f"http://{domain}:80" endpoint_cache[cache_key] = result return result if domains: if ENDPOINT_SCHEME == "https": result = f"https://{domains[0]}" else: result = f"http://{domains[0]}:80" endpoint_cache[cache_key] = result return result ``` ```python # scripts/volcengine_supabase/tools/base.py async def _get_client( self, workspace_id: str, branch_id: Optional[str] = None ) -> SupabaseClient: endpoint = await self.aidap.get_endpoint(workspace_id, branch_id=branch_id) if not endpoint: target = branch_id or workspace_id raise ValueError(f"Could not get endpoint for target {target}") api_key = await self.aidap.get_api_key( workspace_id, "service_role", branch_id=branch_id ) if not api_key: target = branch_id or workspace_id raise ValueError(f"Could not get API key for target {target}") return SupabaseClient(endpoint, api_key) ``` ```python # scripts/volcengine_supabase/platform/supabase_client.py class SupabaseClient: ...[truncated 2835 chars]- Remediation
View remediation