P0/P1 Competitive Test: Cross-File Auth Logic by Ashutosh0x · Pull Request #3 · Ashutosh0x/gemini-code-review-bot

Ashutosh0x · 2026-01-23T08:08:08Z

This PR introduces a new auth module and a test demonstrating a secret leak. Used to verify Gemini's cross-file reasoning and one-click suggestions.

Summary by cubic

Added HMAC-SHA256 signature verification (lib/auth.js) and a cross-file exploit script (lib/auth-exploit.js) that forges a valid signature. This exposes a security risk from a hardcoded secret and non–timing-safe string comparison.

^{Written for commit a4721f8. Summary will update on new commits.}

Ashutosh0x

Gemini AI Review Summary

The code contains a critical vulnerability due to a hardcoded secret key used for HMAC signature verification. The auth-exploit.js file demonstrates how an attacker can exploit this vulnerability to forge signatures and gain unauthorized access. Additionally, the auth.js file uses a non-timing-safe string comparison which could be vulnerable to timing attacks, although the hardcoded secret is the more pressing issue.

Review consolidated to reduce noise.

Ashutosh0x · 2026-01-23T08:08:31Z

@@ -0,0 +1,15 @@
+const crypto = require('crypto');
+
+// WEAK SECRET: Should be in environment variables


Hardcoded secret key

Severity: CRITICAL | Confidence: 100%

Why: The API_SECRET is hardcoded directly in the code. This means anyone with access to the codebase (or even a decompiled version of it) can discover the secret and use it to generate valid signatures for arbitrary payloads. The auth-exploit.js file shows exactly how this can be done.

Suggested Fix:

Suggested change

// WEAK SECRET: Should be in environment variables

const API_SECRET = process.env.API_SECRET;

Ashutosh0x · 2026-01-23T08:08:31Z

+const forgedPayload = "{\"admin\": true}";
+const forgedSig = crypto.createHmac('sha256', KNOWN_SECRET)
+    .update(forgedPayload)
+    .digest('hex');


Demonstration of signature forgery

Severity: CRITICAL | Confidence: 100%

Why: This code directly uses the hardcoded KNOWN_SECRET (which is the same as API_SECRET in auth.js) to create a valid signature for a payload containing {"admin": true}. This shows the direct impact of the hardcoded secret.

Advice: Remove this file from production code. It serves only as a proof-of-concept exploit.

Ashutosh0x · 2026-01-23T08:08:31Z

+        .update(payload)
+        .digest('hex');
+
+    // VULNERABLE: Direct string comparison instead of timing-safe comparison


Timing-unsafe string comparison

Severity: LOW | Confidence: 60%

Why: The === operator performs a direct string comparison, which is vulnerable to timing attacks. If the comparison fails early, it will return faster than if it fails later. This difference in timing can be exploited to reveal the signature.

Advice: Use a timing-safe comparison function to prevent timing attacks.

Ashutosh0x

Gemini AI Review Summary

The code contains a critical vulnerability due to a hardcoded secret key used for HMAC signature verification. The auth-exploit.js file demonstrates how an attacker can exploit this vulnerability to forge signatures and gain unauthorized access. Additionally, the auth.js file uses a non-timing-safe string comparison which could be vulnerable to timing attacks, although the hardcoded secret is the more pressing issue.

Review consolidated to reduce noise.

Ashutosh0x · 2026-01-23T08:13:50Z

@@ -0,0 +1,15 @@
+const crypto = require('crypto');
+
+// WEAK SECRET: Should be in environment variables


Hardcoded secret key

Severity: CRITICAL | Confidence: 100%

Why: The API_SECRET is hardcoded directly in the code. This means anyone with access to the codebase (or even a decompiled version of it) can discover the secret and use it to generate valid signatures for arbitrary payloads. The auth-exploit.js file shows exactly how this can be done.

Suggested Fix:

Suggested change

// WEAK SECRET: Should be in environment variables

const API_SECRET = process.env.API_SECRET;

Ashutosh0x · 2026-01-23T08:13:50Z

+const forgedPayload = "{\"admin\": true}";
+const forgedSig = crypto.createHmac('sha256', KNOWN_SECRET)
+    .update(forgedPayload)
+    .digest('hex');


Demonstration of signature forgery

Severity: CRITICAL | Confidence: 100%

Why: This code directly uses the hardcoded KNOWN_SECRET (which is the same as API_SECRET in auth.js) to create a valid signature for a payload containing {"admin": true}. This shows the direct impact of the hardcoded secret.

Advice: Remove this file from production code. It serves only as a proof-of-concept exploit.

Ashutosh0x · 2026-01-23T08:13:50Z

+        .update(payload)
+        .digest('hex');
+
+    // VULNERABLE: Direct string comparison instead of timing-safe comparison


Timing-unsafe string comparison

Severity: LOW | Confidence: 60%

Why: The === operator performs a direct string comparison, which is vulnerable to timing attacks. If the comparison fails early, it will return faster than if it fails later. This difference in timing can be exploited to reveal the signature.

Advice: Use a timing-safe comparison function to prevent timing attacks.

Ashutosh0x

Gemini AI Review Summary

The code contains a critical vulnerability due to a hardcoded secret key used for HMAC signature verification. The auth-exploit.js file demonstrates how an attacker can exploit this vulnerability to forge signatures and gain unauthorized access. Additionally, the auth.js file uses a non-timing-safe string comparison which could be vulnerable to timing attacks, although the hardcoded secret is the more pressing issue.

Review consolidated to reduce noise.

Ashutosh0x · 2026-01-23T08:16:11Z

@@ -0,0 +1,15 @@
+const crypto = require('crypto');
+
+// WEAK SECRET: Should be in environment variables


Hardcoded secret key

Severity: CRITICAL | Confidence: 100%

Why: The API_SECRET is hardcoded directly in the code. This means anyone with access to the codebase (or even a decompiled version of it) can discover the secret and use it to generate valid signatures for arbitrary payloads. The auth-exploit.js file shows exactly how this can be done.

Suggested Fix:

Suggested change

// WEAK SECRET: Should be in environment variables

const API_SECRET = process.env.API_SECRET;

Ashutosh0x · 2026-01-23T08:16:11Z

+const forgedPayload = "{\"admin\": true}";
+const forgedSig = crypto.createHmac('sha256', KNOWN_SECRET)
+    .update(forgedPayload)
+    .digest('hex');


Demonstration of signature forgery

Severity: CRITICAL | Confidence: 100%

Why: This code directly uses the hardcoded KNOWN_SECRET (which is the same as API_SECRET in auth.js) to create a valid signature for a payload containing {"admin": true}. This shows the direct impact of the hardcoded secret.

Advice: Remove this file from production code. It serves only as a proof-of-concept exploit.

Ashutosh0x · 2026-01-23T08:16:12Z

+        .update(payload)
+        .digest('hex');
+
+    // VULNERABLE: Direct string comparison instead of timing-safe comparison


Timing-unsafe string comparison

Severity: LOW | Confidence: 60%

Why: The === operator performs a direct string comparison, which is vulnerable to timing attacks. If the comparison fails early, it will return faster than if it fails later. This difference in timing can be exploited to reveal the signature.

Advice: Use a timing-safe comparison function to prevent timing attacks.

Ashutosh0x

Gemini AI Review Summary

The code contains a critical vulnerability due to a hardcoded secret key used for HMAC signature verification. The auth-exploit.js file demonstrates how an attacker can exploit this vulnerability to forge signatures and gain unauthorized access. Additionally, the auth.js file uses a non-timing-safe string comparison which could be vulnerable to timing attacks, although the hardcoded secret is the more pressing issue.

Review consolidated to reduce noise.

Ashutosh0x · 2026-01-23T08:16:51Z

@@ -0,0 +1,15 @@
+const crypto = require('crypto');
+
+// WEAK SECRET: Should be in environment variables


Hardcoded secret key

Severity: CRITICAL | Confidence: 100%

Why: The API_SECRET is hardcoded directly in the code. This means anyone with access to the codebase (or even a decompiled version of it) can discover the secret and use it to generate valid signatures for arbitrary payloads. The auth-exploit.js file shows exactly how this can be done.

Suggested Fix:

Suggested change

// WEAK SECRET: Should be in environment variables

const API_SECRET = process.env.API_SECRET;

Ashutosh0x · 2026-01-23T08:16:51Z

+const forgedPayload = "{\"admin\": true}";
+const forgedSig = crypto.createHmac('sha256', KNOWN_SECRET)
+    .update(forgedPayload)
+    .digest('hex');


Demonstration of signature forgery

Severity: CRITICAL | Confidence: 100%

Why: This code directly uses the hardcoded KNOWN_SECRET (which is the same as API_SECRET in auth.js) to create a valid signature for a payload containing {"admin": true}. This shows the direct impact of the hardcoded secret.

Advice: Remove this file from production code. It serves only as a proof-of-concept exploit.

Ashutosh0x · 2026-01-23T08:16:51Z

+        .update(payload)
+        .digest('hex');
+
+    // VULNERABLE: Direct string comparison instead of timing-safe comparison


Timing-unsafe string comparison

Severity: LOW | Confidence: 60%

Why: The === operator performs a direct string comparison, which is vulnerable to timing attacks. If the comparison fails early, it will return faster than if it fails later. This difference in timing can be exploited to reveal the signature.

Advice: Use a timing-safe comparison function to prevent timing attacks.

Ashutosh0x

Gemini AI Review Summary

The code contains a hardcoded secret key used for HMAC signature verification, making it trivial for an attacker to forge signatures. The auth-exploit.js file demonstrates this vulnerability by forging a signature for an admin payload using the known secret and successfully bypassing the authentication check in auth.js.

Review consolidated to reduce noise.

Ashutosh0x · 2026-01-23T08:17:27Z

@@ -0,0 +1,15 @@
+const crypto = require('crypto');
+
+// WEAK SECRET: Should be in environment variables


Hardcoded secret key

Severity: CRITICAL | Confidence: 100%

Why: The API_SECRET is hardcoded directly in the code. This makes it easily discoverable, especially if the code is committed to a public repository. The auth-exploit.js file demonstrates how an attacker can use this known secret to forge a signature.

Suggested Fix:

Suggested change

// WEAK SECRET: Should be in environment variables

const API_SECRET = process.env.API_SECRET;

Ashutosh0x · 2026-01-23T08:17:27Z

+        .update(payload)
+        .digest('hex');
+
+    // VULNERABLE: Direct string comparison instead of timing-safe comparison


Vulnerable to timing attacks

Severity: LOW | Confidence: 70%

Why: The code uses a direct string comparison (===) to compare the expected signature with the provided signature. This is vulnerable to timing attacks, where an attacker can measure the time it takes for the comparison to fail and infer information about the correct signature. While the primary vulnerability is the hardcoded secret, this secondary issue exacerbates the problem.

Advice: Use a timing-safe comparison function to prevent timing attacks.

Ashutosh0x · 2026-01-23T08:17:27Z

+const { verifySignature } = require('./auth');
+const crypto = require('crypto');
+
+// AN ATTACKER WHO KNOWS THE SECRET CAN FORGE SIGNATURES


Hardcoded secret used for exploit

Severity: CRITICAL | Confidence: 100%

Why: This line uses the same hardcoded secret as auth.js to forge a signature, proving the vulnerability.

Advice: Remove this file from production code. It serves only as a demonstration of the vulnerability.

Ashutosh0x

Gemini AI Review Summary

The code contains a hardcoded secret key used for HMAC signature verification, making it trivial for an attacker to forge signatures. The auth-exploit.js file demonstrates this vulnerability by forging a signature for an admin payload.

Review consolidated to reduce noise.

Ashutosh0x · 2026-01-23T08:19:47Z

@@ -0,0 +1,15 @@
+const crypto = require('crypto');
+
+// WEAK SECRET: Should be in environment variables


Hardcoded secret key

Severity: CRITICAL | Confidence: 100%

Why: The API_SECRET is hardcoded directly in the code. This means anyone with access to the codebase (or even decompiled code) can discover the secret and use it to generate valid signatures for arbitrary payloads. The auth-exploit.js file demonstrates how an attacker can exploit this vulnerability.

Suggested Fix:

Suggested change

// WEAK SECRET: Should be in environment variables

const API_SECRET = process.env.API_SECRET;

Ashutosh0x · 2026-01-23T08:19:47Z

+// AN ATTACKER WHO KNOWS THE SECRET CAN FORGE SIGNATURES
+const KNOWN_SECRET = "REALLY_BAD_HARDCODED_SECRET_123";
+const forgedPayload = "{\"admin\": true}";
+const forgedSig = crypto.createHmac('sha256', KNOWN_SECRET)


Demonstration of signature forgery

Severity: CRITICAL | Confidence: 100%

Why: This code directly uses the hardcoded secret from lib/auth.js to create a valid signature for a malicious payload ({"admin": true}). This highlights the severity of the hardcoded secret vulnerability.

Advice: Remove this exploit code from production.

Ashutosh0x · 2026-01-23T08:19:47Z

+        .digest('hex');
+
+    // VULNERABLE: Direct string comparison instead of timing-safe comparison
+    return expected === signature;


Vulnerable timing attack

Severity: LOW | Confidence: 60%

Why: Direct string comparison is susceptible to timing attacks. A timing-safe comparison should be used to prevent attackers from inferring information about the signature by measuring the time it takes for the comparison to complete.

Advice: Use a timing-safe comparison function.

Add core auth logic and exploit test

a4721f8

Ashutosh0x commented Jan 23, 2026

View reviewed changes

Ashutosh0x closed this Jan 23, 2026

Ashutosh0x deleted the feature/secure-auth branch January 23, 2026 08:23

		@@ -0,0 +1,15 @@
		const crypto = require('crypto');

		// WEAK SECRET: Should be in environment variables

	// WEAK SECRET: Should be in environment variables
	const API_SECRET = process.env.API_SECRET;

Conversation

Ashutosh0x commented Jan 23, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by cubic

Uh oh!

Ashutosh0x left a comment

Choose a reason for hiding this comment

Gemini AI Review Summary

Uh oh!

Choose a reason for hiding this comment

Hardcoded secret key

Uh oh!

Choose a reason for hiding this comment

Demonstration of signature forgery

Uh oh!

Choose a reason for hiding this comment

Timing-unsafe string comparison

Uh oh!

Ashutosh0x left a comment

Choose a reason for hiding this comment

Gemini AI Review Summary

Uh oh!

Choose a reason for hiding this comment

Hardcoded secret key

Uh oh!

Choose a reason for hiding this comment

Demonstration of signature forgery

Uh oh!

Choose a reason for hiding this comment

Timing-unsafe string comparison

Uh oh!

Ashutosh0x left a comment

Choose a reason for hiding this comment

Gemini AI Review Summary

Uh oh!

Choose a reason for hiding this comment

Hardcoded secret key

Uh oh!

Choose a reason for hiding this comment

Demonstration of signature forgery

Uh oh!

Choose a reason for hiding this comment

Timing-unsafe string comparison

Uh oh!

Ashutosh0x left a comment

Choose a reason for hiding this comment

Gemini AI Review Summary

Uh oh!

Choose a reason for hiding this comment

Hardcoded secret key

Uh oh!

Choose a reason for hiding this comment

Demonstration of signature forgery

Uh oh!

Choose a reason for hiding this comment

Timing-unsafe string comparison

Uh oh!

Ashutosh0x left a comment

Choose a reason for hiding this comment

Gemini AI Review Summary

Uh oh!

Choose a reason for hiding this comment

Hardcoded secret key

Uh oh!

Choose a reason for hiding this comment

Vulnerable to timing attacks

Uh oh!

Choose a reason for hiding this comment

Hardcoded secret used for exploit

Uh oh!

Ashutosh0x left a comment

Choose a reason for hiding this comment

Gemini AI Review Summary

Uh oh!

Choose a reason for hiding this comment

Hardcoded secret key

Uh oh!

Choose a reason for hiding this comment

Demonstration of signature forgery

Uh oh!

Ashutosh0x commented Jan 23, 2026 •

edited by cubic-dev-ai Bot

Loading