Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
const response = await fetch(source.data);
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.
normalizedConfig.geminiApiKey ?? process.env.GEMINI_API_KEY?.trim();
Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.
Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.
const envApiKey = process.env.GEMINI_API_KEY?.trim();
Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.