Skip to content

Conversation

@TobieTom
Copy link

Security Fix: Private Key Leak in Frontend Error Handling

Severity: Critical
Vulnerability Type: Information Exposure (CWE-532)

Description:
This Pull Request fixes a critical security vulnerability in frontend/src/solanaRPC.ts. previously, the sendToken method explicitly logged the user's raw, plaintext private key to the browser console (console.log) whenever a key length validation error occurred.

Changes:

  • Removed the console.log statement in the error handling block of sendToken.
  • Ensures sensitive key material is never written to stdout or application logs.

Testing:

  • Verified locally with a Jest reproduction script (tests/poc_key_leak.ts).
  • Confirmed that the private key is no longer printed to the console when the error condition is triggered.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant