Crenox in the Wild.

facebook/react GitHub Personal Access Token & Algolia Key Hardcoding

During empirical benchmark scanning of major production repositories using Crenox with overridden file size limits, two hardcoded keys were discovered in the facebook/react codebase: a GitHub Personal Access Token (PAT) inside CI Danger tasks and an Algolia Search API key inside the React MCP server package.

"Crenox successfully extracted obfuscated PAT strings (split across string concatenations) and high-entropy API tokens that bypassed standard single-regex scanners. The token string in the repository has since been revoked by GitHub security automation."

Technical Analysis

// Crenox Detection: signature_id="generic-token-key" / "github-pat"
const token = 'ghp_Uf**********3ZV1' + 'sGqu****************'; // GitHub PAT (Masked)

Leaked Assets Summary

Blooket Production Firebase Key Exposure

During systematic checks of open-source projects, an exposed production Firebase API key belonging to Blooket, an educational platform, was identified. The key was found hardcoded inside a client-side database interaction script.

"This exposure introduces risks of unauthorized database queries, resource consumption, and potential data integrity issues due to client-side database authorization keys."

Technical Analysis

const liveApp = firebase.initializeApp({
    apiKey: "AIzaSyCA-cTOnX19f6LFnDVVsHXya3k***********", // Masked
    authDomain: "blooket-2020.firebaseapp.com",
    projectId: "blooket-2020",
    databaseURL: fbShardURL
});

Remediation Status

A security report was submitted to the Blooket team. Realtime Database rules have been updated to restrict direct client access, and the configuration secrets have been revoked.

Plaintext Configuration and TLS Private Key Exposure in demo-app-stream-org

A security sweep of a workspace associated with the domain link12.ddns.net identified critical credential exposures, including plaintext environment files, Rails cryptographic secrets, and active TLS certificate private keys committed to the Git repository history.

"The ingestion of private keys and environment secrets into version control highlights the critical importance of automated static analysis and pre-commit checks to catch secrets before staging."

Leaked Assets Summary

Exploitation Scenarios & Vector Vectors

• HTTPS Sniffing: Adversaries could intercept and decrypt traffic or spoof the link12.ddns.net domain.
• Cloud Storage: Full access to download, alter, or purge all application attachments in Azure containers.
• Administrative Inbox: Full mail access to nico******************@gmail.com via IMAP, enabling password resets of secondary services.
• Cookie Forgery: Bypass authentication gates using the Rails secret signing key to forge session tokens.

Remediation Steps

An advisory report was compiled and delivered to the system administrator. Critical remediation priorities include certificate revocation, Azure Storage rotation, App Password revocation, and centralized secrets management.