critical
suspicious.exposed_secret_literal
- Location
- dist/plugin-DXTLfG2F.js:35
- Finding
- File appears to expose a hardcoded API secret or token.
- Evidence
clientSecret: [REDACTED]
Openclaw Twitch 2026.5.19.Tgz
AdvisoryAudited by Static analysis on May 20, 2026.
Overview
Detected: suspicious.exposed_secret_literal
Findings (2)
critical
suspicious.exposed_secret_literal
- Location
- dist/setup-surface-BiDFQV9J.js:243
- Finding
- File appears to expose a hardcoded API secret or token.
- Evidence
accessToken: [REDACTED] ?? existing?.accessToken ?? "",