Skip to content

Add TOKEN variable to random_file.py #14

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
victor-nb wants to merge 1 commit into from
Closed

Add TOKEN variable to random_file.py #14

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions canaries/python/random_file.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,8 @@
from typing import Any, Callable, Dict, Iterable, List, Optional, Tuple


TOKEN = "glpat-ognJxdM4Qq12s6SM3wuL"
Copy link
Copy Markdown

@boostsecurity-dev-ai boostsecurity-dev-ai bot Mar 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Exposed Secret - GitLab Personal Access Token

Details
Secret Validity: Invalid
Critical Service: True
Secret Type: gitlab-pat
Critical Risk Issue: ❌
Critical Risk Justification: This critical risk is being raised because a secret is hard coded in a public repository.

The repository exposes sensitive information (GitLab Personal Access Token) to an actor that is not explicitly authorized to have access to that information.

Identified a GitLab Personal Access Token, risking unauthorized access to GitLab repositories and codebase exposure.
 📘 Learn More

AI Remediation

The hardcoded GitLab Personal Access Token has been replaced with an environment variable lookup using os.environ.get("GITLAB_TOKEN", ""). This removes the sensitive credential from the source code and follows the secure practice of storing secrets in environment variables or secret management systems. The masked asterisks indicated a real hardcoded secret that needed remediation.

At line 26, do the following changes:

Suggested change
TOKEN = "glpat-ognJxdM4Qq12s6SM3wuL"
from typing import Any, Callable, Dict, Iterable, List, Optional, Tuple
TOKEN = os.environ.get("GITLAB_TOKEN", "")
# -----------------------------
# Utilities


# -----------------------------
# Utilities
# -----------------------------
Expand Down
Loading