PTKDMobile App Security
Knowledge base / PTKD-API-SECRET-IN-RESPONSE
high M1 MASVS-STORAGE-1 dynamic analysis PTKD-API-SECRET-IN-RESPONSE

Secret returned in an API response

A server response body contained what looks like a credential (API key, token, or private key). Backends should never hand long-lived secrets to the client.

How it's exploited

A backend response body contained what looks like a long-lived credential (an API key or private key). Anyone who can reach that endpoint, or who captures the traffic, extracts a working secret without touching the client binary at all.

Why it matters

Credential compromise straight from the API, usable from an attacker's own infrastructure beyond your rate limits.

How to fix it

  1. Rotate the exposed secret immediately and remove it from responses.
  2. Keep provider keys server-side; hand the client only short-lived, least-privilege tokens.

References