From 5f92dd2ff341fbc782f0c0275c3c96e236cc098b Mon Sep 17 00:00:00 2001
From: Mario Apra <mariotapra@gmail.com>
Date: Fri, 9 Oct 2026 17:46:49 +0100
Subject: [PATCH] fix(security): load Infura key from env

A live Infura project key (Starknet mainnet and sepolia endpoints)
was hardcoded in 5 lines across app/exp001/actions.ts,
app/exp001/index.ts (2 lines, one commented), app/exp001/multicall.ts
and app/starkweb-client/src/index.ts. A security scan on 2026-09-28
confirmed it still answers RPC calls, and the repo is public, so
anyone can use it on the owner's quota.

The URLs now read the key from the INFURA_API_KEY env var. If it is
unset the URL ends in /v3/undefined and Infura returns 401, so it
fails loudly instead of silently.

The key is still in git history, so this does not revoke it. The key
owner (WiseMrMusa) has to rotate it in the Infura dashboard. History
rewrite is not done here.

Claude-Session: https://claude.ai/code/session_01N9kjTzpfMHvVNLhn8TMxvk
---
 app/exp001/actions.ts            | 2 +-
 app/exp001/index.ts              | 4 ++--
 app/exp001/multicall.ts          | 2 +-
 app/starkweb-client/src/index.ts | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/app/exp001/actions.ts b/app/exp001/actions.ts
index 3e3663b..581b235 100644
--- a/app/exp001/actions.ts
+++ b/app/exp001/actions.ts
@@ -7,7 +7,7 @@ import {
 import { http } from '../../packages/starkweb/dist/esm/clients/transports/http';
 
 export const client = createPublicClient({
-    transport: http('https://starknet-sepolia.infura.io/v3/db72641028ee47f5b18bcbb791a3f829'),
+    transport: http(`https://starknet-sepolia.infura.io/v3/${process.env.INFURA_API_KEY}`),
     chain: sepolia,
   })
  
diff --git a/app/exp001/index.ts b/app/exp001/index.ts
index 503ebd9..adbe3c9 100644
--- a/app/exp001/index.ts
+++ b/app/exp001/index.ts
@@ -6,11 +6,11 @@ import { sepolia } from '../../packages/starkweb/dist/esm/chains/definitions/sep
 import { accountABI } from '../../packages/starkweb/dist/esm/utils/siws/account-contract-abi';
 import { stringify } from '../../packages/starkweb/dist/esm/utils/json';
 // export const client = createPublicClient({
-//   transport: http('https://starknet-sepolia.infura.io/v3/db72641028ee47f5b18bcbb791a3f829'),
+//   transport: http(`https://starknet-sepolia.infura.io/v3/${process.env.INFURA_API_KEY}`),
 //   chain: sepolia,
 // })
 
-const result = await http('https://starknet-sepolia.infura.io/v3/db72641028ee47f5b18bcbb791a3f829')
+const result = await http(`https://starknet-sepolia.infura.io/v3/${process.env.INFURA_API_KEY}`)
 const client = result({
   chain: sepolia,
   retryCount: 0,
diff --git a/app/exp001/multicall.ts b/app/exp001/multicall.ts
index 87e578f..113d437 100644
--- a/app/exp001/multicall.ts
+++ b/app/exp001/multicall.ts
@@ -6,7 +6,7 @@ import { sepolia } from '../../packages/starkweb/dist/esm/chains/definitions/sep
 
 
 export const client = createPublicClient({
-    transport: http('https://starknet-sepolia.infura.io/v3/db72641028ee47f5b18bcbb791a3f829'),
+    transport: http(`https://starknet-sepolia.infura.io/v3/${process.env.INFURA_API_KEY}`),
     chain: sepolia,
   })
   
diff --git a/app/starkweb-client/src/index.ts b/app/starkweb-client/src/index.ts
index acfd4d3..50449c1 100644
--- a/app/starkweb-client/src/index.ts
+++ b/app/starkweb-client/src/index.ts
@@ -15,7 +15,7 @@ import { mainnet, sepolia } from 'starkweb/chains';
 
 const publicClient = createPublicClient({
   chain: mainnet,
-  transport: http('https://starknet-mainnet.infura.io/v3/db72641028ee47f5b18bcbb791a3f829'),
+  transport: http(`https://starknet-mainnet.infura.io/v3/${process.env.INFURA_API_KEY}`),
 });
 const id = await getStarknetId(publicClient, {
   domain: 'solene.stark',