Flusk Error - All Images have Secret Key Exposed?

[J805]

I am seeing all of my images show up as an error in Flusk now that says my secret key is exposed. Anyone know what this is about? Even a text element says the same thing. Any idea of what might be going on here? These seem to mostly be images that are directly uploaded using the image element.

[Jici]

Again, maybe related: A roundup of latest security improvements

@fede.bubble There’s a few thing that might have been affected related to this improvment. This one and Critical API Workflow Bug- Not Passing Tokens Fetched

[J805]

Yeah. The last few days Flusk has been going crazy.

[georgecollier]

What’s the error in Flusk and send a screenshot of your image element / any conditions on it maybe?

[J805]

Here you go, here is the error and where it is. The image doesn’t have a conditional on it. @georgecollier When I click on the Fix in Editor button, this is where it took me.

It looks like every image that I directly uploaded has this issue. Does that mean that the API key is being exposed now with images that are directly uploaded?

[georgecollier]

Nah, you can see from the ‘key’ in the issue description that it maps to the CDN subdomain. It seems like the checker falsely flagged that. Submit a bug report and I imagine it’ll be patched pretty quickly?

[J805]

Ok, yeah. It flagged 73 errors on Flusk recently. So I don’t understand what is going on.

[lindsay.esterman]

Thanks for flagging this! Seemed to just be an incident on your app, but it should be fixed now. If you spot anything else, please let us know by filing a bug report!

[J805]

@lindsay.esterman It also has errors anywhere I am using JavaScript, is that something I should let the plugin builder know? Or is this a Bubble issue like the images?

[J805]

Also this random text element? @lindsay.esterman

[georgecollier]

Definitely make a bug report so Bubble can track it and fix it

[J805]

They should still working on my bug report. I submitted it already.

[lindsay.esterman]

Yep, thanks for submitting. We’ve pushed out fixes for both of those and your app should be good now. We’re building in more protections against false positives so this is less likely to happen in the future .