Skip to content

SECURITY-REMEDIATION.md

Latest commit

 

History

History
152 lines (104 loc) · 4.48 KB

SECURITY-REMEDIATION.md

File metadata and controls

152 lines (104 loc) · 4.48 KB

Security Remediation - Exposed Credentials

Date: 2025-12-08 Severity: CRITICAL Status: Code fixed, git history cleanup required

Issue Summary

API credentials were exposed in config.json which was committed to git repository. The following credentials were exposed:

  • Spotify Client ID: 8e7001ee30f04ec196a29a94fddd619e
  • Spotify Client Secret: 597942dc5f3e474481266bc6512cc5e1
  • Google API Key: AIzaSyBFxdpFX61mnqtjBg1QQWaL09nti6ytGH8

What Was Fixed

Code Changes (Completed)

  1. Created environment variable system

    • Created .env.example template
    • Updated spotify_to_yt.py to read from environment variables
    • Added python-dotenv to requirements.txt
    • Added environment loading to application.py

  2. Added config.json to .gitignore

    • Prevents future commits of sensitive files

  3. Added comprehensive error handling

    • All API calls now have proper exception handling
    • Missing credentials fail gracefully with clear error messages

  4. Updated documentation

    • README.md includes environment setup instructions
    • Clear instructions for obtaining API credentials

Required Actions (MUST DO IMMEDIATELY)

1. Revoke Compromised Credentials

These credentials are now public and must be revoked:

Revoke Spotify Credentials

  1. Go to Spotify Developer Dashboard
  2. Find your app with Client ID: 8e7001ee30f04ec196a29a94fddd619e
  3. Regenerate Client Secret or delete and create new app
  4. Update your .env file with new credentials

Revoke Google API Key

  1. Go to Google Cloud Console
  2. Find API key: AIzaSyBFxdpFX61mnqtjBg1QQWaL09nti6ytGH8
  3. Delete the key and create a new one
  4. Update your .env file with new API key

2. Remove Credentials from Git History

WARNING: This rewrites git history. Coordinate with all collaborators first.

# Option A: Use BFG Repo-Cleaner (Recommended)
# Download BFG from https://rtyley.github.io/bfg-repo-cleaner/

# Remove config.json from all commits
java -jar bfg.jar --delete-files config.json
git reflog expire --expire=now --all
git gc --prune=now --aggressive

# Force push to remote (WARNING: Destructive)
git push origin --force --all
git push origin --force --tags

# Option B: Use git-filter-repo
# Install: pip install git-filter-repo

git filter-repo --path config.json --invert-paths
git push origin --force --all
git push origin --force --tags

3. Create .env File Locally

# Copy example file
cp .env.example .env

# Edit .env with your NEW credentials
nano .env

4. Verify Security

# Ensure config.json is not tracked
git status

# Should show config.json as untracked (if it still exists)
# Or should not appear at all

# Verify .env is not tracked
git status

# .env should not appear or should be in .gitignore

Prevention Measures (Already Implemented)

  1. Environment Variables: All secrets now loaded from environment
  2. Gitignore: .env and config.json added to .gitignore
  3. Validation: Application validates environment variables at startup
  4. Documentation: Clear instructions in README.md
  5. Error Handling: Missing credentials produce clear error messages

Security Best Practices Going Forward

  1. Never commit secrets: Use environment variables for all sensitive data
  2. Rotate credentials regularly: Change API keys every 90 days
  3. Use restricted API keys: Limit API key permissions to only what's needed
  4. Monitor API usage: Watch for unusual API activity indicating compromised keys
  5. Use .env for local development: Keep production secrets in secure environment variable stores

Impact Assessment

What Could Have Been Compromised

  • Spotify API: Unauthorized access to your Spotify app quotas
  • Google YouTube API: Unauthorized use of your YouTube API quota (costs money if exceeded)

Recommended Actions

  1. Check Spotify app usage for unauthorized activity
  2. Check Google Cloud Console for unexpected API usage
  3. Monitor for any unusual charges
  4. Revoke and rotate all exposed credentials immediately

Questions?

Contact the security team or refer to: