jaebradley

You would have access to my server token, certainly. But I checked the documentation and in order to request rides, I think you would need other pieces of information that I did not expose. Additionally, there are various scopes that Uber grants regarding the API exposure that any application has.

I think / hope that the worst damage that can be done is hitting Uber's rate limit.

Definitely not defending my decision to include the server token, but I don't think it's the end of the world (just terrible practice).

Gotcha - ok, that certainly makes sense. Though makes for a slightly less friendly (but certainly more secure) service.

It's an NPM package that people download - how would you store it outside the repo such that people that download the package can reference the token? Can't really use an environment variable at that point, right? There probably has to be some HTTP request to some service that ends up forwarding the request to Uber with the token. Maybe I'm over-thinking this...

Hey, I'm the author (thanks @zoodle for notifying me).

Obviously, this is a security issue that is pretty much bottom-of-the-barrel-shitty.

My explanation is that I didn't feel like standing up a middleware service to direct traffic through in order to obfuscate the server token. Especially for a tool that I anticipated being used by pretty much only me.

Not a satisfying answer, but thanks for exposing this security flaw - definitely going to add it to my project task queue.