1.9 KiB
1.9 KiB
F2: Security posture across both repos
Findings
[1] Lidarr API key hardcoded in 5 Python scripts
- quote: "api_key = "24077d03b9a742a786dd799567659cb8""
- url: local (nervura-electrica/rename_lidarr.py:7)
- source_type: primary
- published: 2026
- confidence: high
[2] Telegram bot token hardcoded in watchdog config
- quote: "bot_token: "8992450776:AAHx5xta6BDL3OR7WnWsukWSasCZh3U288E""
- url: local (nervura-electrica/infrastructure/proxmox/watchdog/config.yml:13)
- source_type: primary
- published: 2026
- confidence: high
[3] Session API key leaked in tracked YAML
- quote: "api_key: "bff75943e17f48fb060f1c6321c28b513cad7e8b876c00b11b16e2d067edcdc3""
- url: local (replica-omnisciente/.aurelio/sessions/2026-04-30_antigravity-cdp-integration/session.yaml:93)
- source_type: primary
- published: 2026
- confidence: high
[4] 43% of MCP servers vulnerable to command injection
- quote: "Command injection: 43% of tested MCP servers vulnerable"
- url: https://equixly.com/blog/2025/03/29/mcp-server-new-security-nightmare/
- source_type: secondary
- published: 2025-03-29
- confidence: high
[5] OWASP lists command injection as MCP5:2025
- quote: "MCP5:2025 – Command Injection & Execution. Command injection in MCP environments occurs when an AI agent constructs and executes system commands"
- url: https://owasp.org/www-project-mcp-top-10/
- source_type: primary
- published: 2025
- confidence: high
[6] Cloudflare terminates TLS, can inspect all traffic
- quote: "Using solely cloudflare, is not truly privacy safe"
- url: https://help.nextcloud.com/t/is-cloudflare-tunnel-safe-privacy-focused/150268
- source_type: community
- published: 2024
- confidence: medium
Dead ends
- Could not determine if MCP servers have authentication beyond URL secrecy
- No evidence of secrets scanning in CI pipeline
Suggested follow-ups
- Check if git history has been cleaned of leaked secrets
- Audit MCP server authentication mechanisms