ArchCase

Design · Practice · Interview

Loading…

Secrets in code and leaks through logs

Nodesenior

A new colleague (first PR!) creates a Stripe integration: chargeCustomer, webhook verification, getUserProfile. None of the files existed before. Your job as security reviewer is to walk the diff and find every leak: to git, logs, and API responses.

PR: lesson.typescript +35 −05 проблем

1-// stripe-integration.ts — new file

1+import axios from 'axios'

3+const STRIPE_API_KEY = 'sk_live_4eC39HqLyjWDarjtT1zdp7dc'

4+const WEBHOOK_SECRET = 'whsec_Wj8f0vZnAk2m1xQpLrYtHgBnMcPqRs3D'

6+export async function chargeCustomer(customerId: string, amountCents: number) {

7+ console.log('Charging customer', { customerId, amountCents, apiKey: STRIPE_API_KEY })

9+ try {

10+ const response = await axios.post(

11+ 'https://api.stripe.com/v1/charges',

12+ { customer: customerId, amount: amountCents },

13+ {

14+ headers: { Authorization: `Bearer ${STRIPE_API_KEY}` },

15+ },

16+ )

17+ return response.data

18+ } catch (err) {

19+ console.error('Stripe error:', err)

20+ throw err

21+ }

22+}

23+

24+export function verifyWebhook(payload: string, signature: string): boolean {

25+ return signature === WEBHOOK_SECRET

26+}

27+

28+export async function getUserProfile(userId: string) {

29+ const user = await db.users.findById(userId)

30+ console.log('Loaded user:', user)

31+ return {

32+ id: user.id,

33+ email: user.email,

34+ passwordHash: user.passwordHash,

35+ }

36+}

Шаг 1 из 7

Where to hunt for secret leaks

Secrets leak in three main ways: 1. **Git commit** — hardcoded in code, .env committed, backups in the repo. 2. **Logs** — `console.log(user)`, `console.error(err)`, logging headers with Authorization. 3. **API response to the client** — fields that shouldn't be in the response (passwordHash, internalNotes, privateKey). Plus subtleties: - timing attacks when comparing secrets - axios errors contain request headers - error stacks can reveal internals Walk the code and find problems in all three categories.