binance / binance/binance-connector-python
[Security] Configuration Objects Expose Secrets via Default __dict__ Serialization
- Dominant language
- Python
- Stars
- 2.9k
- Forks
- 697
- PR merge metrics
- No merged PRs in 30d
Description
## Bug Name
Configuration Objects Expose Secrets via Default __dict__ Serialization
## Attack Scenario
ConfigurationRestAPI, ConfigurationWebSocketAPI, and ConfigurationWebSocketStreams are plain Python classes without __repr__ or __str__ overrides. vars(), __dict__, or any serialization will expose api_secret, private_key, and private_key_passphrase in plaintext.
## Impact
Debug logging, error reporting, or framework introspection that serializes configuration objects will leak credentials.
## Components
File: common/src/binance_common/configuration.py. Affects all three Configuration classes.
## Reproduction
1. Create config = ConfigurationRestAPI(api_key='key', api_secret='secret').
2. Call print(vars(config)).
3. Full api_secret is visible in output.
## Fix
Override __repr__ and __str__ to redact sensitive fields. Consider making secrets properties that return masked values in string representations.
## Details
Finding ID: SEC-06
Severity: Low
---
Researcher: Independent Security Researcher -- Mefai Security Team
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.