Submission Details
Severity:
Hardcoded Secrets
Summary
Sensitive information like API keys or passwords are hardcoded, exposing them to misuse.
Vulnerability Details
Affected Code Sections: src/config/config.js (lines 10-12)
Details: API keys exposed in version control history.
Code Snippet:
const apiKeys = {
secretKey: 'YOUR_SECRET_KEY_HERE',
apiKey: 'YOUR_API_KEY_HERE'
};
Impact
Unauthorized access to third-party services and data leaks.
Tools Used
Recommendations
Remove hardcoded secrets; use environment variables or secret management tools (e.g., dotenv, AWS Secrets Manager).
Use .gitignore and Git hooks to prevent sensitive info commits.
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
69929 USDC / LOC
19,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.