Summary
Authorized security review identified wallet private keys and mnemonics committed in:
examples/hrc20/.env (branch master)
Variables affected include LOCAL_*, TESTNET_*, and MAINNET_* private keys and mnemonics.
Risk
Anyone can derive signing keys from this file. Even if balances are currently zero, keys must be considered compromised if they were ever used on mainnet or testnet.
On-chain check (Harmony mainnet, 2026-09-18)
We derived addresses and checked ONE + common HRC-20 tokens — no balances at scan time. Addresses are documented in our private report for maintainer correlation (we will not post seeds/keys in this issue).
Recommended actions
- Replace secrets with placeholders; add
.env.example + gitignore .env
- Rotate any key that may have been used
- Purge git history if real keys were committed
- Enable secret scanning / pre-commit hooks
Happy to coordinate privately if you prefer not to discuss details publicly.
Summary
Authorized security review identified wallet private keys and mnemonics committed in:
examples/hrc20/.env(branchmaster)Variables affected include
LOCAL_*,TESTNET_*, andMAINNET_*private keys and mnemonics.Risk
Anyone can derive signing keys from this file. Even if balances are currently zero, keys must be considered compromised if they were ever used on mainnet or testnet.
On-chain check (Harmony mainnet, 2026-09-18)
We derived addresses and checked ONE + common HRC-20 tokens — no balances at scan time. Addresses are documented in our private report for maintainer correlation (we will not post seeds/keys in this issue).
Recommended actions
.env.example+ gitignore.envHappy to coordinate privately if you prefer not to discuss details publicly.