Commit 18ea7ad
authored
Remove unused fuzzit.sh script and key. (#2797)
In https://github.com/capstone-engine/capstone/security/advisories/GHSA-97v9-6w8p-mh32,
Anton-4 pointed out that the FUZZIT_API_KEY was public in the script.
This is no longer a problem because Fuzzit was acquired by GitLab in 2020,
and they stated that all data was removed six months later.
The advisory was closed by us because it doesn't seem to be a security issue.
However, we don't know at this time if the key was public or private.
If the key was public, it was allowed to be in the repo.
If the key turns out to be private, it very likely has no impact anymore.
Nonetheless, if it later turns out to be private, we can reopen the advisory.
The fix, simply removing the unused script, would still be the same.
GitHub doesn't seem to allow publishing closed advisories,
so the link above unfortunately only works for maintainers.
Thanks a lot, Anton-4, for reporting the issue!
References:
- https://github.com/capstone-engine/capstone/security/advisories/GHSA-97v9-6w8p-mh32
- https://web.archive.org/web/20201026032736/https://fuzzit.dev/2020/06/11/news-fuzzit-is-acquired-by-gitlab/1 parent c597371 commit 18ea7ad
3 files changed
+0
-37
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
71 | 71 | | |
72 | 72 | | |
73 | 73 | | |
74 | | - | |
75 | | - | |
76 | | - | |
77 | | - | |
78 | | - | |
79 | | - | |
80 | | - | |
This file was deleted.
This file was deleted.
0 commit comments