← Scan another repo

github.com/morpheapp/microg-RE

@ a5be29c8ea3c

Submitted 10/23/2026, 4:48:48 PM · Status: ok

Risk grade
F
100 / 100
Findings
55
0 critical13 high42 medium0 low0 info0 on CISA KEV0ATT&CK
Showing 55 of 55 findings

Findings

  • Detected aws-access-token: Identified a pattern that may indicate AWS credentials, risking unauthorized cloud resource access and data breaches on AWS platforms
    Identified a pattern that may indicate AWS credentials, risking unauthorized cloud resource access and data breaches on AWS platforms.
    gitleaks
  • Detected aws-access-token: Identified a pattern that may indicate AWS credentials, risking unauthorized cloud resource access and data breaches on AWS platforms
    Identified a pattern that may indicate AWS credentials, risking unauthorized cloud resource access and data breaches on AWS platforms.
    gitleaks
  • Detected gcp-api-key: Uncovered a GCP API key, which could lead to unauthorized access to Google Cloud services and data breaches
    Uncovered a GCP API key, which could lead to unauthorized access to Google Cloud services and data breaches.
    gitleaks
  • Detected gcp-api-key: Uncovered a GCP API key, which could lead to unauthorized access to Google Cloud services and data breaches
    Uncovered a GCP API key, which could lead to unauthorized access to Google Cloud services and data breaches.
    gitleaks
  • Detected gcp-api-key: Uncovered a GCP API key, which could lead to unauthorized access to Google Cloud services and data breaches
    Uncovered a GCP API key, which could lead to unauthorized access to Google Cloud services and data breaches.
    gitleaks
  • Detected gcp-api-key: Uncovered a GCP API key, which could lead to unauthorized access to Google Cloud services and data breaches
    Uncovered a GCP API key, which could lead to unauthorized access to Google Cloud services and data breaches.
    gitleaks
  • Detected gcp-api-key: Uncovered a GCP API key, which could lead to unauthorized access to Google Cloud services and data breaches
    Uncovered a GCP API key, which could lead to unauthorized access to Google Cloud services and data breaches.
    gitleaks
  • Detected gcp-api-key: Uncovered a GCP API key, which could lead to unauthorized access to Google Cloud services and data breaches
    Uncovered a GCP API key, which could lead to unauthorized access to Google Cloud services and data breaches.
    gitleaks
  • Detected gcp-api-key: Uncovered a GCP API key, which could lead to unauthorized access to Google Cloud services and data breaches
    Uncovered a GCP API key, which could lead to unauthorized access to Google Cloud services and data breaches.
    gitleaks
  • Detected gcp-api-key: Uncovered a GCP API key, which could lead to unauthorized access to Google Cloud services and data breaches
    Uncovered a GCP API key, which could lead to unauthorized access to Google Cloud services and data breaches.
    gitleaks
  • Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operations
    Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    gitleaks
  • Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operations
    Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    gitleaks
  • Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operations
    Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    gitleaks
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(Back Merge Main to Dev)
    checkov.github/workflows/back_merge.yml:0
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(Release)
    checkov.github/workflows/release.yml:10
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(Open a PR to main)
    checkov.github/workflows/open_pull_request.yml:0
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(Crowdin push from GitHub)
    checkov.github/workflows/crowdin_push.yml:0
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(Crowdin pull and merge)
    checkov.github/workflows/crowdin_pull.yml:11
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepplay-services-safetynet/core/src/main/kotlin/org/microg/gms/safetynet/SafetyNetClientService.kt:45
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepplay-services-core/src/main/kotlin/org/microg/gms/auth/credentials/provider/GoogleIdService.kt:170
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepplay-services-core/src/main/kotlin/org/microg/gms/cryptauth/CryptAuthRequests.kt:28
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepplay-services-core/src/main/kotlin/org/microg/gms/findmydevice/extensions.kt:23
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepplay-services-core/src/main/kotlin/org/microg/gms/games/achievements/AchievementResponseKt.kt:14
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepplay-services-core/src/main/kotlin/org/microg/gms/games/leaderboards/LeaderboardResponseKt.kt:17
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepplay-services-core/src/main/kotlin/org/microg/gms/potokens/extensions.kt:18
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepplay-services-core/src/main/kotlin/org/microg/gms/ui/SafetyNetFragment.kt:138
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepplay-services-core/src/main/kotlin/org/microg/gms/wallet/extensions.kt:17
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepplay-services-games/src/main/java/com/google/android/gms/games/PlayerColumns.java:59
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepplay-services-nearby/core/src/main/kotlin/org/microg/gms/nearby/exposurenotification/ExposureDatabase.kt:868
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepplay-services-nearby/core/src/main/kotlin/org/microg/gms/nearby/exposurenotification/ExposureDatabase.kt:870
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepplay-services-nearby/src/main/java/com/google/android/gms/nearby/exposurenotification/ExposureNotificationClient.java:73
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepvending-app/src/main/kotlin/com/google/android/finsky/IntegrityExtensions.kt:533
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepfirebase-auth/core/src/main/assets/recaptcha.html:37
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepfirebase-auth/src/main/java/org/microg/gms/firebase/auth/Constants.java:9
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepplay-services-auth/src/main/java/com/google/android/gms/auth/api/identity/AuthorizationRequest.java:62
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepplay-services-auth/src/main/java/com/google/android/gms/auth/api/identity/SaveAccountLinkingTokenRequest.java:27
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepplay-services-base/core/src/main/kotlin/org/microg/gms/settings/SettingsContract.kt:106
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepplay-services-base/src/main/java/com/google/android/gms/auth/api/signin/GoogleSignInOptions.java:349
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepplay-services-base/src/main/java/com/google/android/gms/auth/api/signin/internal/Storage.java:35
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepplay-services-basement/src/main/java/org/microg/gms/auth/AuthConstants.java:25
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepplay-services-basement/src/main/java/org/microg/gms/auth/AuthConstants.java:26
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepplay-services-core/src/main/java/org/microg/gms/auth/AuthManager.java:194
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepplay-services-core/src/main/java/org/microg/gms/auth/AuthManagerServiceImpl.java:155
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepplay-services-core/src/main/java/org/microg/gms/auth/AuthManagerServiceImpl.java:267
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepplay-services-core/src/main/java/org/microg/gms/auth/login/LoginActivity.java:97
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepplay-services-core/src/main/java/org/microg/gms/auth/login/LoginActivity.java:108
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepplay-services-core/src/main/java/org/microg/gms/auth/loginservice/AccountAuthenticator.java:105
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepplay-services-core/src/main/java/org/microg/gms/auth/loginservice/AccountAuthenticator.java:145
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepplay-services-core/src/main/java/org/microg/gms/wallet/OwServiceImpl.java:52
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepplay-services-core/src/main/kotlin/com/google/android/gms/family/v2/manage/FamilyExtensions.kt:54
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepplay-services-core/src/main/kotlin/com/google/android/gms/maps/auth/ApiTokenService.kt:35
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepplay-services-core/src/main/kotlin/com/google/android/gms/maps/auth/ApiTokenService.kt:39
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepplay-services-core/src/main/kotlin/com/google/android/gms/semanticlocationhistory/db/OdlhStorageManager.kt:64
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepplay-services-core/src/main/kotlin/org/microg/gms/auth/capabilities/UserDataKeys.kt:19
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepplay-services-core/src/main/kotlin/org/microg/gms/auth/capabilities/UserDataKeys.kt:28

This report is public.