bimface-helper-backend

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the entire skill docs for literal values that look like real, high-entropy credentials (API tokens, access keys, signatures, base64 policies, etc.). I flagged only values that are not obvious placeholders and that have high entropy / token-like form and therefore could be usable credentials if live.

Findings (examples of high-entropy, token-like literals present in the docs):

• Authorization Bearer examples repeated throughout:
• "cn-e9725999-0b36-4c0e-bdca-38ea88888888" — shown as Bearer token in many request headers (looks like an access token).
• appKey-like values in responses:
• "odatvZYUSAWMbdUjTU8HoZXB9tFt6123" — appears repeatedly as an appKey in response JSON.
• Object storage / OSS credentials and identifiers:
• "QLYNXu7B9OTjErYR" — shown as accessId / OSSAccessKeyId in policy and signed URL examples.
• Signatures and base64 tokens (policy/callback/signature):
• "mf/uEFxQVGwbEHP1RCd2O5z3TdA=" (signature)
• long base64 policy strings such as "eyJleHBpcmF0aW9uIjoiMjAyMy0wMy0xNlQwMzowNDo0Mi45OTVaIiwiY29uZGl0aW9ucyI6W1siY29udGVudC1sZW5ndGgtcmFuZ2UiLDAsMTA3Mzc0MTgyNF0seyJzdWNjZXNzX2FjdGlvbl9zdGF0dXMiOiIyMDAifSxbInN0YXJ0cy13aXRoIiwiJGtleSIsIiJdXX0=" (policy)
• URL-encoded signatures in signed URLs like "Signature=Kkv3acXo%2B6a9407nj3afgi8XaM8%3D"
• Other token-like IDs in signed URLs / responses:
• "663CC225BC4845D59341CD06F9A9EA12" and "309FAD8B9E124888888888668F" (uploadId / object ids) — these are identifiers but some are long hex-like strings.

Rationale: these values are not generic placeholders (they are not "YOUR_API_KEY" or "your_app_key_here"), they are long, random-looking, and used in contexts that would grant access (Authorization: Bearer, OSSAccessKeyId, signatures, policy strings). Per the secret definition (high-entropy literal values that provide access), these are credentials or credential-like artifacts and should be treated as secrets.

Items I ignored / did not flag:

• Placeholder examples such as BIMFACE_APP_KEY=your_app_key_here and BIMFACE_APP_SECRET=your_app_secret_here (explicit placeholders) — ignored per rules.
• Low-entropy example passwords like "sdfgth" shown as a share password — considered a simple example / low-entropy and therefore not flagged.
• Numeric IDs (fileId, projectId, etc.) — these are resource identifiers, not secrets.
• Any truncated or redacted-looking tokens with "..." were treated as non-actionable placeholders.

If you want, I can extract a complete list (with file/section locations) of every credential-like literal above to help remediate (rotate/remove) them.

MEDIUM W021: Hidden or invisible Unicode characters detected (potential obfuscation or prompt injection).

• Hidden Unicode characters detected (1 type(s) found)