T09 · Insecure Skill Coding Practices
Warning
- Location
handlers/_http.js:1- Finding
Sensitive Customer and Transaction Data Transmitted over Plaintext HTTP
- Content
View full analysis
{ if (v !== undefined && v !== null && v !== '') { url.searchParams.set(k, String(v)); } }); } const normalizedBody = body ? withDefaults(body) : null; if (normalizedBody) { const shopErr = ensureShopId(normalizedBody); if (shopErr) { return shopErr; } } const init = { method, headers: { Accept: 'application/json', ...(normalizedBody ? { 'Content-Type': 'application/json' } : {}), ...(normalizedBody ? buildContextHeaders(normalizedBody) : {}), ...(headers || {}), }, }; if (normalizedBody) { init.body = JSON.stringify(normalizedBody); } const response = await fetch(url.toString(), init); ``` The package configuration also declares the plaintext endpoint: ```json "config": { "apiBase": "http://10.200.100.32:9302" } ``` ### Technical Analysis The default API endpoint uses HTTP rather than HTTPS. Requests can contain customer names, phone numbers, member i ...[truncated 2015 chars]- Remediation
View remediation