← ALL FINDINGS

BG-002 · backend/config.py:11

Hardcoded API Secret

CRITICAL✓ FIXED

Vulnerability description

A live third-party API secret is committed in source control as a plaintext constant.

Security impact

Anyone with repository read access can impersonate the service against the payment provider and issue authenticated requests.

Recommended remediation

Load the secret from the environment at runtime, remove it from history, and rotate the credential.

Fix

Before

API_SECRET = "sk_live_51H8xQe2eZvKYlo2C9Xa7"

After

API_SECRET = os.environ["API_SECRET"]
if not API_SECRET:
    raise RuntimeError("API_SECRET is not configured")

Regression test

test_no_hardcoded_secrets_in_source

def test_no_hardcoded_secrets_in_source():
    matches = scan_repo(pattern=r"sk_live_[A-Za-z0-9]+")
    assert matches == []

Affected file

backend/config.py

Line 11

Affected code path

config.py (module import) → payments.client(API_SECRET)

Verification result

  • ✓Regression test generated
  • ✓Test passed
  • ✓Fix verified