Security-related question about a possible exposed credential

[Emma-NYL]

Hello,

My name is Emma, I am conducting an academic study on possible credential exposure in public GitHub repositories.

While analyzing this repository, I found a string that may represent a credential. I'm including the code snippet below containing possible leakage. To avoid exposing sensitive information publicly, I marked the sensitive information.

Could you please help clarify whether the detected string is:

1. a real credential, or
2. a placeholder / example value?

Thank you for your time.

---

Code snippet (sensitive values masked):

// Needed to parse the request body.
app.use(bodyParser.urlencoded({ extended: true }));

// Needed for session management
app.use(sessions({
    cookieName: 'session',
    secret: 'random_st****_goes_here',
    duration: 3 * 60 * 1000,
    activeDuration: 5 * 60 * 1000
}));

// Needed to enable view engine
app.set('view engine', 'ejs');

Thank you in advance for your time - I really appreciate it!

Sincerely,
Emma

[jimm-sys]

Hello Emma, Thank you for reaching out and for reviewing the repository. The value you highlighted (random_st****_goes_here) is only a placeholder example used for demonstration purposes and is not an actual credential used in any production or deployed environment. I appreciate you bringing this to my attention and for your work in helping improve open-source security. Best regards, James Njuguna NJihia MId-level Sptingboot dev

…

On Tue, Mar 10, 2026 at 1:32 AM Emma-NYL ***@***.***> wrote: *Emma-NYL* created an issue (dbortiz/Secure-Banking-Application#1) <#1> Hello, My name is Emma, I am conducting an academic study on possible credential exposure in public GitHub repositories. While analyzing this repository, I found a string that may represent a credential. I'm including the code snippet below containing possible leakage. To avoid exposing sensitive information publicly, I marked the sensitive information. Could you please help clarify whether the detected string is: 1. a real credential, or 2. a placeholder / example value? Thank you for your time. ------------------------------ *Code snippet (sensitive values masked):* // Needed to parse the request body. app.use(bodyParser.urlencoded({ extended: true })); // Needed for session management app.use(sessions({ cookieName: 'session', secret: 'random_st****_goes_here', duration: 3 * 60 * 1000, activeDuration: 5 * 60 * 1000 })); // Needed to enable view engine app.set('view engine', 'ejs'); Thank you in advance for your time - I really appreciate it! Sincerely, Emma — Reply to this email directly, view it on GitHub <#1>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ARDM3WAH6QOV4IO6MI67WX34P5BATAVCNFSM6AAAAACWMMWYE2VHI2DSMVQWIX3LMV43ASLTON2WKOZUGA2DQMRWGIZTEMA> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>