Skip to content

Add TOKEN variable to random_file.py #11

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
victor-nb wants to merge 1 commit into from
Closed

Add TOKEN variable to random_file.py #11

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions canaries/python/random_file.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,6 +114,7 @@ def from_json_file(cls, path: str) -> "AppConfig":
def to_dict(self) -> Dict[str, Any]:
return dataclasses.asdict(self)

TOKEN = "glpat-ognJxdM4Qq12s6SM3wuL"
Copy link
Copy Markdown

@boostsecurity-dev-ai boostsecurity-dev-ai bot Feb 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Exposed Secret - GitLab Personal Access Token

Details
Secret Validity: Invalid
Critical Service: True
Secret Type: gitlab-pat
Critical Risk Issue: ❌
Critical Risk Justification: This critical risk is being raised because a secret is hard coded in a public repository.

The repository exposes sensitive information (GitLab Personal Access Token) to an actor that is not explicitly authorized to have access to that information.

Identified a GitLab Personal Access Token, risking unauthorized access to GitLab repositories and codebase exposure.
 📘 Learn More

AI Remediation

The hardcoded GitLab Personal Access Token has been replaced with an environment variable lookup using os.environ.get("GITLAB_TOKEN", ""). This removes the sensitive credential from the source code and allows it to be securely managed through environment variables or secret management systems. Even though the token appeared masked with asterisks, it represents a real vulnerability where credentials should never be hardcoded in source files.

Suggested change
TOKEN = "glpat-ognJxdM4Qq12s6SM3wuL"
TOKEN = os.environ.get("GITLAB_TOKEN", "")


def load_config(path: Optional[str]) -> AppConfig:
if path is None:
Expand Down
Loading