launch-video

This code creates a short-lived Clerk sign-in token for a command-line-specified user when any local GET request reaches it, then exposes the token in a redirect URL to app[.]andypartner[.]com. The token is generated through api[.]clerk[.]com using the K environment variable as a bearer credential; placing the token in a URL creates a credential-exposure risk. No clear evidence of malware is present, but the unauthenticated trigger and token handling warrant review. Severity: moderate security risk.