CSRF token is leaking on invalid request

CSRF token should be unique ,unpredictable . But in this request if the user is not login , csrf is leaking https://keybase.io/_/api/1.0/sig/next_seqno.json , which can be used again next time when user is login .

CSRF token should not appear in a failed/error request

Start by reproducing the unauthenticated request to https://keybase.io/_/api/1.0/sig/next_seqno.json and inspect the failed response for the CSRF token. Done means the error response no longer exposes a reusable CSRF token while the later authenticated request still receives valid CSRF protection.

Written by the indexing model from the issue text.