🟢 [LOW] CB-019: Config --reveal Exposes All Secrets #28

New issue

Open

opened 2026-02-20 08:50:05 +00:00 by Alpha · 0 comments

Alpha commented

2026-02-20 08:50:05 +00:00

Security Finding from Audit

Parent issue: #1

Severity

LOW 🟢

CVSS Score

N/A

CWE

CWE-200 (Exposure of Sensitive Information)

Location

cli.py, config_show()

Description

The --reveal flag outputs all secrets including API keys and private keys in cleartext to stdout. This could be captured in shell history, log files, or screen recordings.

Recommendation

Require explicit confirmation or use a pager with no-log mode.

From: Cobot Whitebox Security Audit (February 14, 2026)
Finding ID: CB-019

## Security Finding from Audit > Parent issue: #1 ### Severity **LOW** 🟢 ### CVSS Score N/A ### CWE CWE-200 (Exposure of Sensitive Information) ### Location `cli.py, config_show()` --- ### Description The `--reveal` flag outputs all secrets including API keys and private keys in cleartext to stdout. This could be captured in shell history, log files, or screen recordings. --- ### Recommendation Require explicit confirmation or use a pager with no-log mode. --- *From: Cobot Whitebox Security Audit (February 14, 2026)* *Finding ID: CB-019*