Root + Impact

The secret in set_secret is stored in plain text and the blockchain is a global storage, hence anyone can check the contents of the secret from the account resources

Description

Sensitive information like secrets/passwords should not store it's original contents but the hash of it's contents should be stored instead

Risk

Likelihood:

High: Anyone can check the contents of the caller's resoiurces to see the secret

Impact:

High: Exposed Keys

Recommended Mitigation

Hash the secret in set_secret before storing the value in the vault