Investigate Hardcoded credentials in a URL
Build 3.52.4 · Scan 2026-09-30T03:21:43.563Z
3 distinct recorded findings; 3 have inspectable metadata. Locations are representative, not an inventory of every source match.
A username and password are embedded directly in a URL inside the app. If that host is reachable, this is a hardcoded credential and should be rotated. Confirm it isn't a placeholder/example first.
Static evidence does not establish runtime impact. Source excerpts and line numbers were not recorded.
Evidence preview
- Evidence type
- Static string match
- Representative location
assets/com.shopee.bke.lib.apm-filecache-service.json- Recorded match
•••••••• (40+ chars, redacted)- Detector rule
basic_auth_url- Recorded file locations
assets/com.shopee.bke.lib.apm-filecache-service.jsonassets/com.shopee.bke.lib.apm-net.jsonassets/com.shopee.bke.lib.apm-event-center.jsonassets/com.shopee.bke.lib.apm-startup.jsonassets/com.shopee.bke.lib.apm-storage-api.jsonassets/com.shopee.bke.lib.apm-looper.jsonassets/com.shopee.bke.lib.hermes-tool.jsonassets/com.shopee.bke.lib.apm-net-quality.jsonassets/com.shopee.bke.lib.apm-vm-api.jsonassets/com.shopee.bke.lib.apm-oktcp-api.json