High-Impact Disclosure Log

Crenox in the Wild.

A technical audit archive documenting security vulnerabilities and plaintext credentials identified within public infrastructures.

July 12, 2026

CRITICAL RESPONSIBLY DISCLOSED

Blooket Production Firebase Key Exposure

During systematic checks of open-source projects, an exposed production Firebase API key belonging to Blooket, an educational platform, was identified. The key was found hardcoded inside a client-side database interaction script.

"This exposure introduces risks of unauthorized database queries, resource consumption, and potential data integrity issues due to client-side database authorization keys."

Technical Analysis

floodGame.js — commit: 96193758

const liveApp = firebase.initializeApp({
    apiKey: "AIzaSyCA-cTOnX19f6LFnDVVsHXya3k***********", // Masked
    authDomain: "blooket-2020.firebaseapp.com",
    projectId: "blooket-2020",
    databaseURL: fbShardURL
});

Remediation Status

A security report was submitted to the Blooket team. Realtime Database rules have been updated to restrict direct client access, and the configuration secrets have been revoked.

July 11, 2026

FULL COMPROMISE REPORTED

Plaintext Configuration and TLS Private Key Exposure in demo-app-stream-org

A security sweep of a workspace associated with the domain link12.ddns.net identified critical credential exposures, including plaintext environment files, Rails cryptographic secrets, and active TLS certificate private keys committed to the Git repository history.

"The ingestion of private keys and environment secrets into version control highlights the critical importance of automated static analysis and pre-commit checks to catch secrets before staging."

Leaked Assets Summary

Severity	Asset Type	Exposed Path
CRITICAL	TLS Certificate Private Key	`.gitlab/.../nginx/certs/privkey.pem`
CRITICAL	Azure Blob Storage Access Key	`backend/.env`
CRITICAL	Gmail IMAP App Password	`backend/.env`
HIGH	Rails `SECRET_KEY_BASE`	`backend/.env`
HIGH	Internal backup URL with IP Address	`config/initializers/backup.rb`

Exploitation Scenarios & Vector Vectors

HTTPS Sniffing: Adversaries could intercept and decrypt traffic or spoof the link12.ddns.net domain.
Cloud Storage: Full access to download, alter, or purge all application attachments in Azure containers.
Administrative Inbox: Full mail access to nico******************@gmail.com via IMAP, enabling password resets of secondary services.
Cookie Forgery: Bypass authentication gates using the Rails secret signing key to forge session tokens.

Remediation Steps

An advisory report was compiled and delivered to the system administrator. Critical remediation priorities include certificate revocation, Azure Storage rotation, App Password revocation, and centralized secrets management.