Low-severity findings in ncameiri/validate_protocol
Alongside the high-risk issues, our system also flagged multiple low-severity items that affect code quality:
• Unused variables (params, start)
• Unused async promises
• Unused requestCache map
• Unused nodeStats map
• Unused constant values (CACHE_TTL_MS)
Individually small, but together they add noise, reduce efficiency, and make future debugging harder.
Sharing these for full transparency.
More updates to follow.
More findings from our analysis of ncameiri/validate_protocol
Our system flagged two additional security issues in the current MVP build.
1. Secret exposure
A private key is imported directly from ./keys.ts.
If this file ends up in git history or a public repo, the key becomes exposed to anyone.
Developers should move secrets into environment variables and avoid shipping sensitive values in source code.
2. Missing input validation
The handler accepts any JSON body without checking or validating its structure.
A malicious payload could break the parser or cause downstream failures when forwarded to a Solana RPC node.
Simple schema checks would prevent this.