Tracked entrypoint encourages provider secrets to be stored in source

[tg12]

Summary

WireTapper's tracked entrypoint configures third-party provider credentials as source-level constants instead of requiring runtime secret injection, encouraging secret-in-code deployments for WiGLE, OpenCellID, and Shodan access.

Evidence

• https://github.com/h9zdev/WireTapper/blob/main/app.py#L9-L13 defines WIGLE_API_TOKEN, OPENCELLID_API_KEY, and SHODAN_API_KEY as module constants in tracked source.
• The same values are consumed directly in provider calls, for example WiGLE auth at https://github.com/h9zdev/WireTapper/blob/main/app.py#L83-L87 and Shodan usage at https://github.com/h9zdev/WireTapper/blob/main/app.py#L170-L174.
• A second tracked entrypoint, app-env.py, uses environment variables, showing conflicting secret-handling models within the same repository.

Why this matters

Even when the checked-in values are placeholders, the design tells operators to put provider credentials into source code. That creates avoidable commit leakage, poor rotation discipline, and divergent runtime behavior between entrypoints.

Attack or failure scenario

An operator pastes live WiGLE or Shodan credentials into app.py to get the demo working quickly, then commits or copies the file into deployment artifacts. The credential is now embedded in source history and local backups.

Root cause

The repository mixes a demo-style hardcoded config path with an environment-based config path instead of enforcing a single runtime secret boundary.

Recommended fix

1. Remove provider credential constants from tracked source entrypoints.
2. Require environment-backed secret injection in every runnable entrypoint.
3. Fail startup if required provider credentials are missing rather than inviting source edits.
4. Add secret-scanning checks to prevent future commits of provider keys.

Acceptance criteria

• No tracked entrypoint contains provider credential fields as editable source constants.
• All provider auth flows read from environment or managed secrets only.
• Documentation reflects a single secret-handling model.

Suggested labels

• security
• technical-debt
• production-readiness

Priority

P2 (Medium)

Severity

Medium — the repository encourages secret-in-code operation and inconsistent credential custody.

Confidence

Confirmed — the tracked source constants and their provider usage are explicit.