T09 · Insecure Skill Coding Practices
- Location
main.py:7- Finding
Hardcoded SkillPay API Credential
- Content
View full analysis
Vulnerability Details
File Location:
main.py, lines 7–8
Vulnerability Type: Hardcoded secret in source code
Risk Level: HighVulnerable Code
python SKILLPAY_API_KEY = "sk_8b36c2ca9e774eb0243752f907b086e78c8af866a4088d3e3475113ed446b71" SKILLPAY_API_BASE = "https://api.skillpay.me"Technical Analysis
A secret-looking SkillPay API credential is embedded directly in distributable source code. Any person or system with access to the project package can recover this value without authentication.
Although
main.pydoes not currently use the credential and the configured entry point ispython bare.py, inclusion in the package still constitutes credential exposure. Static analysis cannot establish whether the key is active, expired, revoked, or which permissions it grants. Removing it from the current file alone may also be insufficient if it exists in repository history, build artifacts, logs, caches, or previously distributed packages.Attack Path
- An attacker obtains the project source, package, build artifact, or repository history.
- The attacker reads
main.pyand extractsSKILLPAY_API_KEY. - The attacker attempts to authenticate to
https://api.skillpay.meusing the exposed key. - If the credential remains valid, the attacker invokes API operations allowed by its assigned permissions.
- The attacker may continue using the credential until it is revoked, rotated, expired, or blocked by provider-side restrictions.
No interaction with the running application is necessary to extract the credential.
Impact Assessment
If the key is valid, an attacker could impersonate the associated API client and obtain all privileges granted to that credential. Depending on provider-side authorization, this could include consuming paid resources, creating unauthorized transactions or payment objects, accessing account-related API data, or disrupting legitimate service usage.
The precise scope cannot be confirmed from th ...[truncated 175 chars]
- Remediation
View remediation
Remediation Suggestions
- Revoke the exposed credential immediately and issue a replacement; do not assume deletion from the source makes the existing key safe.
- Remove the credential from the current source, repository history, release archives, build artifacts, logs, and caches where feasible.
- Supply the replacement through a managed secret store or protected environment variable:
python import os SKILLPAY_API_KEY = os.environ.get("SKILLPAY_API_KEY") if not SKILLPAY_API_KEY: raise RuntimeError("SKILLPAY_API_KEY is not configured")- Do not commit example secrets that resemble usable credentials. Use an unmistakable placeholder in documentation, such as
SKILLPAY_API_KEY=replace_me. - Grant the replacement key only the minimum API permissions required by the application.
- Apply provider-supported restrictions, such as environment, account, endpoint, source-network, spending, or rate limits.
- Review SkillPay access and transaction logs for use of the exposed credential and investigate unexpected activity.
- Add automated secret scanning to pre-commit hooks and CI pipelines to prevent recurrence.
- Ensure production deployments inject secrets at runtime and prevent secret values from appearing in exception messages or application logs.