Mozilla · Report #1992261

Flickr API key leaked in GitHub commit

Validstatus

lowseverity

24upvotes

26 Oct 2023disclosed

Summary

A security researcher discovered a leaked Flickr API key in a public GitHub repository belonging to Mozilla. The key is used to pull public data from Flickr and did not pose a security risk.

This report is out of scope of our program and was resolved since we were able to revoke the API key. It is not eligible for bounty. Similar reports would be closed as informative.

How it was found

Hello security team,

My Name is Mayank Kumar. I am a Cyber Security Researcher, Bug Bounty Hunter & Ethical Hacker.

While going through Github search I discovered a public repository which contains API Key.

Repo: https://github.com/mozilla/make.mozilla.org

File: https://github.com/mozilla/make.mozilla.org/blob/98b87c517b463a5bae09f29284b1dabca97bb376/media/js/flickr.js#L4

POC: Screenshot Attached

Impact

Information Disclosure

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original