Assessment reportsPublic findings
Back to Zellic site
↗
Assessment reports>Reclaim Protocol>Low findings>Production credentials in Git source repositories
GeneralOverview
Findings
Critical (4)
High (2)
Medium (5)
Low (6)XSS via ignored content-disposition headerAddress bar not updated before page loadImproper TLS certificate parsingImproper host validation in QR-code proof requestProduction credentials in Git source repositoriesLack of sufficient claim-parameter validation
Informational (2)
DiscussionSpoofing risk via website data format instabilitySpoofing risk via insecure contains/RegEx checksSensitive data exposure riskUser-phishing riskLack of `postMessage` origin validationProxy/scraping service usageNode centralization risk
Audit ResultsSummary
Category: Coding Mistakes

Production credentials in Git source repositories

Low Severity
Low Impact
High Likelihood

Description

The witness-sdk/src/providers/irs/irs-address.ts file was found to contain a credential for a proxy service:

'Authorization: Basic VTA...TZa',

Impact

If the Reclaim source code is ever publicly released, an attacker may compromise Reclaim's proxy service credentials.

Recommendations

The credential should be rotated, removed from the Git repository, and instead moved into an environment variable.

Remediation

This issue has been acknowledged by CreatorOS Inc, and the credentials have been revoked.

Zellic © 2025Back to top ↑