# Exposed secrets in bundles and config

Credentials readable by untrusted parties that grant server-side or cross-tenant authority

_Area: Web infrastructure and server-side requests. Seen in 11 disclosed reports; 9 confirmed bounties, median $3,500, range $750-$50,000; latest 2026-10-20. Updated 2026-10-23._

## How it works
A credential that should stay server-side ends up where an untrusted party can read it: a client bundle, an archive, a config file, a system index, an archived response. The broken assumption is "the client only sees what we intend." Build steps, default installers, vendor defaults, and request-snapshotting features copy credentials into readable places, and the credential's privilege class is usually far higher than the code carrying it needs.

## Where it shows up
- Unreferenced `.env` or config files inside Electron `app.asar` archives [E1](https://bugbountylibrary.com/r/h1%3A1087489.md)
- Vendor default certs/keys reused from public repos (DTLS, WebRTC) [E2](https://bugbountylibrary.com/r/h1%3A531032.md)
- Internal indices that snapshot request headers, e.g. `.async-search` [E3](https://bugbountylibrary.com/r/h1%3A1042716.md)
- Config files under `Program Files\...\Application Data` with default ACLs [E4](https://bugbountylibrary.com/r/bc%3Ab6d6b145-6261-4936-983c-0badc86ec1ad.md)
- Config/settings API responses preserved in web archives [E5](https://bugbountylibrary.com/r/blog%3Arashahacks-com-how-i-pwned-10-admin-panels-and-rewarded-8000.md)
- Third-party widget keys in storefront JS that also authenticate a vendor API [E8](https://bugbountylibrary.com/r/blog%3Acrypt0g30rgy-github-io-post-journey2pii.md)
- Localization/i18n API keys in client requests with write scope [E6](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-pancakeswap-content-injection-bugfix-review.md)
- Directory-listed backup archives containing `wp-config.php` [E7](https://bugbountylibrary.com/r/h1%3A439223.md)

## How to review
The invariant: every credential reachable by an untrusted party must be scoped to that party's authority, or absent. For each candidate secret, establish (a) who can read it, (b) what authority it grants, (c) whether that authority is server-side only. Decode embedded strings, extract archives, check file ACLs, and enumerate `_source` fields of system indices [E3](https://bugbountylibrary.com/r/h1%3A1042716.md). Presence is not proof: distinguish revoked from active credentials, and note that reading `.async-search` requires superuser [E3](https://bugbountylibrary.com/r/h1%3A1042716.md).

## Variants seen
- GitHub PAT in a leftover `.env` inside `app.asar` [E1](https://bugbountylibrary.com/r/h1%3A1087489.md)
- Public-domain default DTLS private key [E2](https://bugbountylibrary.com/r/h1%3A531032.md)
- Plaintext Authorization headers in `.async-search` [E3](https://bugbountylibrary.com/r/h1%3A1042716.md)
- World-readable DB creds in `confluence.cfg.xml` [E4](https://bugbountylibrary.com/r/bc%3Ab6d6b145-6261-4936-983c-0badc86ec1ad.md)
- Admin creds in an archived `/api/v1/config` response, reused across environments [E5](https://bugbountylibrary.com/r/blog%3Arashahacks-com-how-i-pwned-10-admin-panels-and-rewarded-8000.md)
- Over-privileged Crowdin write token in frontend requests [E6](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-pancakeswap-content-injection-bugfix-review.md)
- Shared-host backup zip leaking MySQL creds [E7](https://bugbountylibrary.com/r/h1%3A439223.md)
- Storefront API key reused for server-side loyalty API [E8](https://bugbountylibrary.com/r/blog%3Acrypt0g30rgy-github-io-post-journey2pii.md)

## Why fixes fail
Removing a secret from code without rotating it leaves the old value valid [E1](https://bugbountylibrary.com/r/h1%3A1087489.md). Credentials reused across production, staging, and development mean one leak unlocks all [E5](https://bugbountylibrary.com/r/blog%3Arashahacks-com-how-i-pwned-10-admin-panels-and-rewarded-8000.md).

## Impact and severity
Ranged from customer PII exposure via a third-party vendor API [E8](https://bugbountylibrary.com/r/blog%3Acrypt0g30rgy-github-io-post-journey2pii.md) and site content injection for phishing [E6](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-pancakeswap-content-injection-bugfix-review.md) to repo-wide push access [E1](https://bugbountylibrary.com/r/h1%3A1087489.md), media stream hijack [E2](https://bugbountylibrary.com/r/h1%3A531032.md), credential harvesting for lateral movement [E3](https://bugbountylibrary.com/r/h1%3A1042716.md), local-to-SYSTEM escalation [E4](https://bugbountylibrary.com/r/bc%3Ab6d6b145-6261-4936-983c-0badc86ec1ad.md), admin-panel takeover across ten apps [E5](https://bugbountylibrary.com/r/blog%3Arashahacks-com-how-i-pwned-10-admin-panels-and-rewarded-8000.md), and cross-tenant database access [E7](https://bugbountylibrary.com/r/h1%3A439223.md). Severity rises with the credential's blast radius, its reuse across environments, and whether it is unrotated.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A1087489.md
- E2: https://bugbountylibrary.com/r/h1%3A531032.md
- E3: https://bugbountylibrary.com/r/h1%3A1042716.md
- E4: https://bugbountylibrary.com/r/bc%3Ab6d6b145-6261-4936-983c-0badc86ec1ad.md
- E5: https://bugbountylibrary.com/r/blog%3Arashahacks-com-how-i-pwned-10-admin-panels-and-rewarded-8000.md
- E6: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-pancakeswap-content-injection-bugfix-review.md
- E7: https://bugbountylibrary.com/r/h1%3A439223.md
- E8: https://bugbountylibrary.com/r/blog%3Acrypt0g30rgy-github-io-post-journey2pii.md