Repository navigation
Conversation
A live Infura project key (Starknet mainnet and sepolia endpoints) was hardcoded in 5 lines across app/exp001/actions.ts, app/exp001/index.ts (2 lines, one commented), app/exp001/multicall.ts and app/starkweb-client/src/index.ts. A security scan on 2026-09-28 confirmed it still answers RPC calls, and the repo is public, so anyone can use it on the owner's quota. The URLs now read the key from the INFURA_API_KEY env var. If it is unset the URL ends in /v3/undefined and Infura returns 401, so it fails loudly instead of silently. The key is still in git history, so this does not revoke it. The key owner (WiseMrMusa) has to rotate it in the Infura dashboard. History rewrite is not done here. Claude-Session: https://claude.ai/code/session_01N9kjTzpfMHvVNLhn8TMxvk
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
I noticed that a live Infura key is hardcoded in 5 lines under app/exp001 and app/starkweb-client, and a scan on 2026-09-28 confirmed it still answers RPC calls. The repo is public, so anyone can burn the owner's quota.
The fix is to read it from INFURA_API_KEY; unset, Infura returns 401 so it fails loudly. The key stays in git history, so WiseMrMusa still has to rotate it in the Infura dashboard.