CWE-540 in the Wild: Hardcoded Credentials in a Production Analytics Script

https://webverselabs-pro.com/

Some targets give it away in the design. Pebble & Pine didn't. It's a small ceramics studio site — two people, a barn, seasonal mug drops. The whole thing reads like it was built with care, not carelessness. Minimal. Quiet. No trackers, they claim.

But I've stopped trusting "we don't track you" claims at face value, so the first stop was the journal page. And there it was — not a technical hint, but a human one. A post titled "New website, brother-shaped", where Marit casually mentions her brother Felix built the site over a weekend:

"He also wrote the analytics file, which apparently we are supposed to ignore for now. He says he'll come back to it. He always says he'll come back to it."

That sentence did more work than any scanner could have. Someone, in the site's own words, told me exactly where to look — and exactly why it was worth looking there.

Finding the file

The obvious guess paid off immediately:

/static/js/analytics.js

/static/js/analytics.js

Nothing hidden about it. No auth wall, no obscure path — just sitting at a predictable static asset location, like most analytics scripts do.

The top of the file was exactly what you'd expect: scroll-depth tracking, outbound click detection, a debounce function so it doesn't spam events. Boring, competent, forgettable code.

Then, right after the init() function — the part of the file a developer writes last and reviews least — there was a comment block that didn't belong in anything resembling "finished":

js

// ── Internal reconciliation hook — DO NOT REMOVE ──
// The newsletter exporter pulls this constant to tag CSV rows so
// Sasha can match returns to the original campaign batch. Marit's
// brother left it here when he split the analytics file out from
// the campaign tracker. Will remove when the v0.5 split lands.
const INTERNAL_REF = "WEBVERSE{...}";
window.__pp = window.__pp || {};
window.__pp.ref = INTERNAL_REF;

// ── Internal reconciliation hook — DO NOT REMOVE ──
// The newsletter exporter pulls this constant to tag CSV rows so
// Sasha can match returns to the original campaign batch. Marit's
// brother left it here when he split the analytics file out from
// the campaign tracker. Will remove when the v0.5 split lands.
const INTERNAL_REF = "WEBVERSE{...}";
window.__pp = window.__pp || {};
window.__pp.ref = INTERNAL_REF;

A hardcoded internal reference token, labeled "DO NOT REMOVE," explained away by a version split that — going by the comment's own tone — was never actually coming. And just in case reading the file wasn't convenient enough, it was also exposed live in the browser via window.__pp.ref.

Why this one stuck with me

This wasn't a vulnerability that needed a tool. No Burp, no fuzzing, no payloads. Just reading a JavaScript file the way you'd read a note left on a desk. And that's exactly why it's dangerous in the real world — JS files get treated as "just frontend," something designers touch and security reviewers skip. But a JS file ships to every visitor's browser. Anything in it is public, permanently, the moment it's deployed.

The comment is almost a confession. "Will remove when the v0.5 split lands" is the development equivalent of "I'll fix it next sprint." Felix wrote that once, moved on, and the constant just… stayed. Production doesn't forget the way people do.

Remediation, for Felix and everyone like him

• Treat every static asset — JS, CSS, source maps — as public, because it is.
• Never park "temporary" secrets or internal references in client-side code, even behind a comment promising cleanup.
• If something is internal-only (like a campaign reconciliation ID), it belongs server-side, never in a variable the browser can read.
• window.__anything holding a real token is a code smell worth flagging in every review.

Takeaway

The glaze recipes weren't the only thing being refined at Pebble & Pine — so was the excuse for leaving a secret in production. "We'll come back to it" is rarely a plan. It's usually just the sentence right before someone else finds it first.