Mars · Report #2396630
sensitive data-creds for database - private key
Validstatus
mediumseverity
27upvotes
19 Nov 2024disclosed
Summary
A set of sensitive database credentials has been discovered in a publicly accessible GitHub repository. The exposed credentials include a username and password for a database named "█████████" along with a private key. The credentials are stored in plaintext within a configuration file, making them directly accessible to anyone who can view the repository. This exposure represents a significant security risk as it violates the principle of secure credential management.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.