binance / binance/binance-connector-python

[Security] Configuration Objects Expose Secrets via Default __dict__ Serialization

Open
#513 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
2.9k
Forks
697
PR merge metrics
No merged PRs in 30d

Description

## Bug Name
Configuration Objects Expose Secrets via Default __dict__ Serialization

## Attack Scenario
ConfigurationRestAPI, ConfigurationWebSocketAPI, and ConfigurationWebSocketStreams are plain Python classes without __repr__ or __str__ overrides. vars(), __dict__, or any serialization will expose api_secret, private_key, and private_key_passphrase in plaintext.

## Impact
Debug logging, error reporting, or framework introspection that serializes configuration objects will leak credentials.

## Components
File: common/src/binance_common/configuration.py. Affects all three Configuration classes.

## Reproduction
1. Create config = ConfigurationRestAPI(api_key='key', api_secret='secret').
2. Call print(vars(config)).
3. Full api_secret is visible in output.

## Fix
Override __repr__ and __str__ to redact sensitive fields. Consider making secrets properties that return masked values in string representations.

## Details
Finding ID: SEC-06
Severity: Low

---
Researcher: Independent Security Researcher -- Mefai Security Team

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.