Skip to content

Stackshift/week eight - #69

Open
emmaglorypraise wants to merge 10 commits into
celo-org:mainfrom
emmaglorypraise:stackshift/week-eight
Open

Stackshift/week eight#69
emmaglorypraise wants to merge 10 commits into
celo-org:mainfrom
emmaglorypraise:stackshift/week-eight

Conversation

@emmaglorypraise

@emmaglorypraise emmaglorypraise commented Jun 14, 2023

Copy link
Copy Markdown

A find a friend directory to easily send money to your friends via their twitter username

@gitguardian

gitguardian Bot commented Jun 14, 2023 •
edited
Loading

Copy link
Copy Markdown

⚠️ GitGuardian has uncovered 12 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request
GitGuardian id Secret Commit Filename
- Generic High Entropy Secret 7a88dd4 packages/react-app/.env View secret
- Generic High Entropy Secret 7a88dd4 packages/react-app/.env View secret
- Generic High Entropy Secret 7a88dd4 packages/react-app/.env View secret
- Generic High Entropy Secret fe272bf packages/react-app/.env View secret
- Generic High Entropy Secret fe272bf packages/react-app/.env View secret
- Generic High Entropy Secret fe272bf packages/react-app/.env View secret
- Generic High Entropy Secret fe272bf packages/react-app/.env View secret
- Generic High Entropy Secret fe272bf packages/react-app/pages/api/[...nextauth].ts View secret
- Generic High Entropy Secret fe272bf packages/react-app/pages/api/[...nextauth].ts View secret
- Generic High Entropy Secret 56c3fcc packages/react-app/.env View secret
- Generic High Entropy Secret 56c3fcc packages/react-app/.env View secret
- Generic High Entropy Secret 56c3fcc packages/react-app/.env View secret
🛠 Guidelines to remediate hardcoded secrets
  1. Understand the implications of revoking this secret by investigating where it is used in your code.
  2. Replace and store your secrets safely. Learn here the best practices.
  3. Revoke and rotate these secrets.
  4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.

Our GitHub checks need improvements? Share your feedbacks!

@socket-security

socket-security Bot commented Jun 14, 2023

Copy link
Copy Markdown

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Issue Package Version Note Source
Git dependency @celo/identity 4.1.0 packages/react-app/package.json
Native code bigint-buffer 1.1.5 packages/react-app/package.json via @celo/rainbowkit-celo@0.8.1, @celo/react-celo@4.3.0, @rainbow-me/rainbowkit@0.12.14, wagmi@0.12.15
Install scripts bigint-buffer 1.1.5
  • Install script: install
  • Source: npm run rebuild || echo "Couldn't build bindings. Non-native version used."
 packages/react-app/package.json via @celo/rainbowkit-celo@0.8.1, @celo/react-celo@4.3.0, @rainbow-me/rainbowkit@0.12.14, wagmi@0.12.15
Native code bufferutil 4.0.7 package.json via @celo/identity@4.1.0, packages/react-app/package.json via @celo/contractkit@3.1.0, @celo/identity@4.1.0, @celo/rainbowkit-celo@0.8.1, @celo/react-celo@4.3.0, @rainbow-me/rainbowkit@0.12.14, ethers@5.7.2, wagmi@0.12.15, web3@1.10.0
Native code dtrace-provider 0.8.8 package.json via @celo/identity@4.1.0, packages/react-app/package.json via @celo/identity@4.1.0
Native code keccak 3.0.3 package.json via @celo/identity@4.1.0, packages/react-app/package.json via @celo/contractkit@3.1.0, @celo/identity@4.1.0, @celo/rainbowkit-celo@0.8.1, @celo/react-celo@4.3.0, @rainbow-me/rainbowkit@0.12.14, wagmi@0.12.15, web3@1.10.0
Native code secp256k1 4.0.3 package.json via @celo/identity@4.1.0, packages/react-app/package.json via @celo/contractkit@3.1.0, @celo/identity@4.1.0, @celo/rainbowkit-celo@0.8.1, @celo/react-celo@4.3.0, @rainbow-me/rainbowkit@0.12.14, wagmi@0.12.15, web3@1.10.0
Native code utf-8-validate 5.0.10 package.json via @celo/identity@4.1.0, packages/react-app/package.json via @celo/contractkit@3.1.0, @celo/identity@4.1.0, @celo/rainbowkit-celo@0.8.1, @celo/react-celo@4.3.0, @rainbow-me/rainbowkit@0.12.14, ethers@5.7.2, wagmi@0.12.15, web3@1.10.0
Install scripts web3 1.10.0
  • Install script: postinstall
  • Source: echo "Web3.js 4.x alpha has been released for early testing and feedback. Checkout doc at https://docs.web3js.org/ "
 packages/react-app/package.json via @celo/react-celo@4.3.0
Install scripts web3 1.3.6
  • Install script: postinstall
  • Source: echo "WARNING: the web3-shh and web3-bzz api will be deprecated in the next version"
 package.json via @celo/identity@4.1.0, packages/react-app/package.json via @celo/contractkit@3.1.0, @celo/identity@4.1.0, @celo/react-celo@4.3.0
Install scripts web3-bzz 1.10.0
  • Install script: postinstall
  • Source: echo "WARNING: the web3-bzz api will be deprecated in the next version"
 packages/react-app/package.json via @celo/react-celo@4.3.0, web3@1.10.0
Install scripts web3-bzz 1.3.6
  • Install script: postinstall
  • Source: echo "WARNING: the web3-bzz api will be deprecated in the next version"
 package.json via @celo/identity@4.1.0, packages/react-app/package.json via @celo/contractkit@3.1.0, @celo/identity@4.1.0, @celo/react-celo@4.3.0
Install scripts web3-shh 1.10.0
  • Install script: postinstall
  • Source: echo "WARNING: the web3-shh api will be deprecated in the next version"
 packages/react-app/package.json via @celo/react-celo@4.3.0, web3@1.10.0
Install scripts web3-shh 1.3.6
  • Install script: postinstall
  • Source: echo "WARNING: the web3-shh api will be deprecated in the next version"
 package.json via @celo/identity@4.1.0, packages/react-app/package.json via @celo/contractkit@3.1.0, @celo/identity@4.1.0, @celo/react-celo@4.3.0
Install scripts es5-ext 0.10.62
  • Install script: postinstall
  • Source: node -e "try{require('./_postinstall')}catch(e){}" || exit 0
 package.json via @celo/identity@4.1.0, packages/react-app/package.json via @celo/contractkit@3.1.0, @celo/identity@4.1.0, @celo/react-celo@4.3.0, web3@1.10.0
Protestware/Troll package es5-ext 0.10.62
  • Note: This package prints a protestware console message on install regarding Ukraine for users with Russian language locale
 package.json via @celo/identity@4.1.0, packages/react-app/package.json via @celo/contractkit@3.1.0, @celo/identity@4.1.0, @celo/react-celo@4.3.0, web3@1.10.0
Network access defer-to-connect 1.1.3 package.json via @celo/identity@4.1.0, packages/react-app/package.json via @celo/contractkit@3.1.0, @celo/identity@4.1.0, @celo/react-celo@4.3.0
Network access forever-agent 0.6.1 package.json via @celo/identity@4.1.0, packages/react-app/package.json via @celo/contractkit@3.1.0, @celo/identity@4.1.0, @celo/react-celo@4.3.0, web3@1.10.0
Network access http2-wrapper 1.0.3 package.json via @celo/identity@4.1.0, packages/react-app/package.json via @celo/contractkit@3.1.0, @celo/identity@4.1.0, @celo/react-celo@4.3.0, web3@1.10.0
Network access http2-wrapper 2.2.0 packages/react-app/package.json via @celo/react-celo@4.3.0, web3@1.10.0
Network access jayson 3.7.0 packages/react-app/package.json via @celo/rainbowkit-celo@0.8.1, @celo/react-celo@4.3.0, @rainbow-me/rainbowkit@0.12.14, wagmi@0.12.15
Network access next 13.2.4 packages/react-app/package.json
Telemetry next 13.2.4
  • Note: Can be disabled by setting the environment variable NEXT_TELEMETRY_DISABLED=1
 packages/react-app/package.json
Network access next 13.4.5 package.json via next-auth@4.22.1, packages/react-app/package.json via next-auth@4.22.1
Telemetry next 13.4.5
  • Note: Can be disabled by setting the environment variable NEXT_TELEMETRY_DISABLED=1
 package.json via next-auth@4.22.1, packages/react-app/package.json via next-auth@4.22.1
Network access resolve-alpn 1.2.1 package.json via @celo/identity@4.1.0, packages/react-app/package.json via @celo/contractkit@3.1.0, @celo/identity@4.1.0, @celo/react-celo@4.3.0, web3@1.10.0
Network access tunnel-agent 0.6.0 package.json via @celo/identity@4.1.0, packages/react-app/package.json via @celo/contractkit@3.1.0, @celo/identity@4.1.0, @celo/react-celo@4.3.0, web3@1.10.0
Network access ws 7.4.6 packages/react-app/package.json via @celo/rainbowkit-celo@0.8.1, @celo/react-celo@4.3.0, @rainbow-me/rainbowkit@0.12.14, ethers@5.7.2, wagmi@0.12.15
Network access ws 7.5.3 packages/react-app/package.json via @celo/rainbowkit-celo@0.8.1, @celo/react-celo@4.3.0
Network access ws 7.5.9
Network access ws 8.12.0 packages/react-app/package.json via @celo/rainbowkit-celo@0.8.1, @celo/react-celo@4.3.0, @rainbow-me/rainbowkit@0.12.14, wagmi@0.12.15
Network access ws 3.3.3 package.json via @celo/identity@4.1.0, packages/react-app/package.json via @celo/contractkit@3.1.0, @celo/identity@4.1.0, @celo/react-celo@4.3.0, web3@1.10.0
Network access @ethersproject/web 5.7.1 package.json via @celo/identity@4.1.0, packages/react-app/package.json via @celo/contractkit@3.1.0, @celo/identity@4.1.0, @celo/rainbowkit-celo@0.8.1, @celo/react-celo@4.3.0, @rainbow-me/rainbowkit@0.12.14, ethers@5.7.2, wagmi@0.12.15, web3@1.10.0
Network access @solana/web3.js 1.73.1 packages/react-app/package.json via @celo/rainbowkit-celo@0.8.1, @celo/react-celo@4.3.0, @rainbow-me/rainbowkit@0.12.14, wagmi@0.12.15
Network access @walletconnect/core 1.8.0 packages/react-app/package.json via @celo/rainbowkit-celo@0.8.1, @celo/react-celo@4.3.0
Network access @walletconnect/core 2.7.4
Network access @walletconnect/ethereum-provider 1.8.0 packages/react-app/package.json via @celo/rainbowkit-celo@0.8.1
Network access @walletconnect/ethereum-provider 2.7.4
Network access @walletconnect/jsonrpc-http-connection 1.0.4 packages/react-app/package.json via @celo/rainbowkit-celo@0.8.1
Network access @walletconnect/jsonrpc-http-connection 1.0.6 packages/react-app/package.json via @celo/rainbowkit-celo@0.8.1, @rainbow-me/rainbowkit@0.12.14, wagmi@0.12.15
Network access @walletconnect/legacy-client 2.0.0 packages/react-app/package.json via @celo/rainbowkit-celo@0.8.1, @rainbow-me/rainbowkit@0.12.14, wagmi@0.12.15
Network access @walletconnect/legacy-modal 2.0.0 packages/react-app/package.json via @celo/rainbowkit-celo@0.8.1, @rainbow-me/rainbowkit@0.12.14, wagmi@0.12.15
Network access @walletconnect/legacy-provider 2.0.0 packages/react-app/package.json via @celo/rainbowkit-celo@0.8.1, @rainbow-me/rainbowkit@0.12.14, wagmi@0.12.15
Network access @walletconnect/qrcode-modal 1.8.0 packages/react-app/package.json via @celo/rainbowkit-celo@0.8.1
Network access @walletconnect/signer-connection 1.8.0 packages/react-app/package.json via @celo/rainbowkit-celo@0.8.1
Network access @web3modal/core 2.4.3
Network access abortcontroller-polyfill 1.7.5 packages/react-app/package.json via @celo/react-celo@4.3.0, web3@1.10.0
Network access cross-fetch 3.0.4 package.json via @celo/identity@4.1.0, packages/react-app/package.json via @celo/identity@4.1.0
Network access cross-fetch 3.1.5 package.json via @celo/identity@4.1.0, packages/react-app/package.json via @celo/contractkit@3.1.0, @celo/identity@4.1.0, @celo/rainbowkit-celo@0.8.1, @celo/react-celo@4.3.0, @rainbow-me/rainbowkit@0.12.14, wagmi@0.12.15, web3@1.10.0
Network access ethers 5.7.2 packages/react-app/package.json via @celo/rainbowkit-celo@0.8.1, @rainbow-me/rainbowkit@0.12.14, wagmi@0.12.15
Network access isomorphic-fetch 3.0.0 packages/react-app/package.json via @celo/react-celo@4.3.0
Network access next-auth 4.22.1 packages/react-app/package.json
Network access node-fetch 2.6.0 package.json via @celo/identity@4.1.0, packages/react-app/package.json via @celo/identity@4.1.0
Network access node-fetch 2.6.7 package.json via @celo/identity@4.1.0, twitter-api-sdk@1.2.1, packages/react-app/package.json via @celo/identity@4.1.0, @celo/rainbowkit-celo@0.8.1, @rainbow-me/rainbowkit@0.12.14, twitter-api-sdk@1.2.1, wagmi@0.12.15
Network access node-fetch 2.6.9 packages/react-app/package.json via @celo/contractkit@3.1.0, @celo/rainbowkit-celo@0.8.1, @celo/react-celo@4.3.0<

@socket-security

socket-security Bot commented Jun 14, 2023

Copy link
Copy Markdown

New and updated dependency changes detected. Learn more about Socket for GitHub ↗︎

Packages Version New capabilities Transitives1 Size Publisher
next 🆕 13.2.4 eval, network, filesystem, shell, environment +28 1.2 GB vercel-release-bot
next-auth 🆕 4.22.1 eval, network, filesystem, shell, environment +92 1.96 GB balazsorban
@celo/identity 🆕 4.1.0 eval, network, filesystem, shell, environment +814 110 MB aaron-clabs
eslint-config-next 🆕 13.1.6 eval, network, filesystem, shell, environment +248 100 MB vercel-release-bot
@types/node 🆕 18.15.2 None +0 3.62 MB types
typescript 🆕 4.9.5 filesystem +0 66.8 MB typescript-bot
@celo/rainbowkit-celo 🆕 0.8.1 eval, network, filesystem, shell, environment +368 161 MB aaron-clabs
@celo/react-celo 🆕 4.3.0 eval, network, filesystem, shell, environment +579 102 MB aaron-clabs
web3 🆕 1.10.0 eval, network, filesystem, shell, environment +325 39 MB jdevcs
autoprefixer 🆕 10.4.13 filesystem, shell, environment +13 2.88 MB ai
react-hot-toast 🆕 2.4.1 filesystem, environment +14 12.7 MB timolins
twitter-api-sdk 🆕 1.2.1 network +12 1.85 MB refarer
eslint 🆕 8.36.0 eval, network, filesystem, shell, environment +119 18.1 MB eslintbot
postcss 🆕 8.4.14 filesystem, environment +3 362 kB ai
react-icons 🆕 4.9.0 filesystem, environment +6 57.4 MB nolanleung
@heroicons/react 🆕 2.0.14 filesystem, environment +3 2.66 MB reinink
react-dom 🆕 18.2.0 filesystem, environment +4 4.93 MB gnoff
@rainbow-me/rainbowkit 🆕 0.12.14 eval, network, filesystem, shell, environment +331 155 MB danielsinclair
@types/react-dom 🆕 18.0.10 None +4 1.41 MB types
axios 🆕 1.4.0 network, filesystem, environment +8 2.12 MB jasonsaayman
dotenv 🆕 16.1.4 filesystem, environment +0 67.6 kB motdotla
react 🆕 18.2.0 filesystem, environment +2 337 kB gnoff
@headlessui/react 🆕 1.7.8 filesystem, environment +6 5.82 MB malfaitrobin
tailwindcss 🆕 3.2.4 filesystem, shell, environment +75 79.5 MB adamwathan
wagmi 🆕 0.12.15 eval, network, filesystem, shell, environment +281 150 MB jmoxey
@types/react 🆕 18.0.27 None +3 1.38 MB types
ethers 🆕 5.7.2 network, filesystem, shell, environment +47 16.6 MB ricmoo
@celo/contractkit 🆕 3.1.0 eval, network, filesystem, shell, environment +363 42.7 MB aaron-clabs

Footnotes

  1. https://docs.socket.dev ↩

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@emmaglorypraise