search

andreroggeri / pynubank

Acesse seus extratos do Nubank pelo Python
MIT License
1.19k stars 180 forks source link

Client secret is a hard coded? #320

Closed IgorDePaula closed 2 years ago

IgorDePaula commented 2 years ago

https://github.com/andreroggeri/pynubank/blob/master/pynubank/nubank.py#L58

andreroggeri commented 2 years ago

Not so secret eh ?

It can be found on their website (search for this secret)

IgorDePaula commented 2 years ago

https://docs.nupaybusiness.com.br/#/checkout/?id=credenciais

andreroggeri commented 2 years ago

Thats a different API.

This is a thin wrapper around the APIs used for the web app and the mobile app

andreroggeri commented 2 years ago

If you have any questions please let me know.

IgorDePaula commented 2 years ago

Ok, I only want make an alert security of your code.

andreroggeri commented 2 years ago

But what is the problem ? The client secret is the same used by the Nubank official webapp (The link that I sent you on the first reply)

I don't see any way to make this work without this secret (Client secrets are not so secret because anyone can decompile, instrument or inspect requests to get it)