# Predictable-path secret exposure

Default certs, world-readable configs, and plaintext credential dotfiles that ship or install with guessable paths

_Area: Web infrastructure and server-side requests. Seen in 2 disclosed reports; 2 confirmed bounties: $800 and $2,000; latest 2024-01-04. Updated 2026-11-02._

## How it works
A secret is only secret if its location and value are both unknown. This pattern breaks the location half: the credential sits at a path fixed by the vendor, the installer, or the tool's own convention, and is either plaintext or protected by a key that ships alongside it. Anyone who knows the product knows where to look, so the secret is effectively public even when it is never leaked in a breach. The broken assumption is "nobody knows this file exists" — but the path is in the repo, the installer, or the malware author's hardcoded list.

## Where it shows up
- Vendor default TLS/DTLS certs and private keys committed to an upstream repo and left in place at deploy time [E1](https://bugbountylibrary.com/r/h1%3A531032.md)
- Config files under `Program Files\...\Application Data` whose ACLs grant `BUILTIN\Users` read, holding cleartext DB credentials [E2](https://bugbountylibrary.com/r/bc%3Ab6d6b145-6261-4936-983c-0badc86ec1ad.md)
- Per-user dotfiles holding long-lived tokens or master keys: `.claude/credentials.json`, `.codex/auth.json`, `.aws/credentials`, `.ssh` keys, IDE state DBs [E3](https://bugbountylibrary.com/r/blog%3Aresearch-checkpoint-com-2026-infostealer-riding-the-ai-train.md)
- Encryption whose key is derived from a seed stored next to the ciphertext [E3](https://bugbountylibrary.com/r/blog%3Aresearch-checkpoint-com-2026-infostealer-riding-the-ai-train.md)
- Any secret whose path is documented, conventional, or enumerable from a shipped binary

## How to review
For each secret, ask two questions: who can read it, and how would an attacker find it? The invariant: a secret must be unreadable to unprivileged principals AND its path must not be derivable from public information. Check ACLs on config files on the actual install, not the docs [E2](https://bugbountylibrary.com/r/bc%3Ab6d6b145-6261-4936-983c-0badc86ec1ad.md). Fingerprint live TLS/DTLS endpoints against known default certs [E1](https://bugbountylibrary.com/r/h1%3A531032.md). Enumerate dotfile paths a credential-stealing process would target and confirm tokens are short-lived or OS-protected [E3](https://bugbountylibrary.com/r/blog%3Aresearch-checkpoint-com-2026-infostealer-riding-the-ai-train.md).

## How finders spotted it
- Saw the DTLS cert string `rainmaker` in STUN packets, then matched the `about:webrtc-internals` fingerprint against the default Janus cert removed from the public repo [E1](https://bugbountylibrary.com/r/h1%3A531032.md)
- Noted the default install grants `BUILTIN\Users` read on `confluence.cfg.xml`, then followed the DB credentials to app-admin [E2](https://bugbountylibrary.com/r/bc%3Ab6d6b145-6261-4936-983c-0badc86ec1ad.md)
- Reverse-engineered the stealer's config section, key derivation, and hardcoded path list to map exactly which predictable paths it harvests [E3](https://bugbountylibrary.com/r/blog%3Aresearch-checkpoint-com-2026-infostealer-riding-the-ai-train.md)

## Variants seen
- Shipped default key in a network protocol endpoint [E1](https://bugbountylibrary.com/r/h1%3A531032.md)
- World-readable config file leaking DB credentials on a server OS [E2](https://bugbountylibrary.com/r/bc%3Ab6d6b145-6261-4936-983c-0badc86ec1ad.md)
- Plaintext or trivially decryptable per-user credential files harvested by malware [E3](https://bugbountylibrary.com/r/blog%3Aresearch-checkpoint-com-2026-infostealer-riding-the-ai-train.md)

## Impact and severity
E1 enabled MITM hijack of SRTP media streams [E1](https://bugbountylibrary.com/r/h1%3A531032.md). E2 chained file-permission leak to DB write, app-admin, RCE, and `SeImpersonate` to SYSTEM [E2](https://bugbountylibrary.com/r/bc%3Ab6d6b145-6261-4936-983c-0badc86ec1ad.md). E3 scaled from one workstation to developer repos and cloud infrastructure by chaining AI-tool, cloud-CLI, and SSH credentials [E3](https://bugbountylibrary.com/r/blog%3Aresearch-checkpoint-com-2026-infostealer-riding-the-ai-train.md). Severity rises with what the secret unlocks and how many hosts share the same predictable path.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A531032.md
- E2: https://bugbountylibrary.com/r/bc%3Ab6d6b145-6261-4936-983c-0badc86ec1ad.md
- E3: https://bugbountylibrary.com/r/blog%3Aresearch-checkpoint-com-2026-infostealer-riding-the-ai-train.md