maksimamelchenko/finex-monorepo

Monorepo for Budget Tracker & Planner FINEX.io

finex-monorepo's Issues

NX_CLOUD_ACCESS_TOKEN exposure in github

hello team i am bug hunter i don't know if you have bug bounty program or not but i wanted to report this to you
i have find this access token in github hhttps://github.com/MaksimAmelchenko/finex-monorepo/blob/master/nx.json
"accessToken": "YWI4MzU1NTktMTA1ZC00NjQxLTliY2MtMzk5Y2JhMTc5MDhmfHJlYWQtd3JpdGU="
i decode it and found this
has read-write privileges
if you see this video which explains what is nx https://nx.dev/nx-cloud/intro/what-is-nx-cloud
nx cloud allow runs any command across multiple machines so this token allows the attacker to run commands
reference:
nrwl/nx#15767
https://nx.dev/nx-cloud/account/access-tokens
impact
exposure of read and write access token in github which allow ru any command in any device in the workspace of nx cloud