[Security] API Key Transmitted in Header for Unauthenticated Endpoints

[mefai-dev]

Bug Name

API Key Transmitted in Header for Unauthenticated Endpoints

Attack Scenario

The API constructor sets X-MBX-APIKEY header on the session for ALL requests. This means the API key is sent even for public endpoints like ping(), time(), exchange_info(), depth(), trades(), klines(), etc.

Impact

Unnecessary API key exposure on public endpoints increases attack surface. If traffic is intercepted, API key is leaked even when user only intended to fetch public market data.

Components

File: /binance/api.py, lines 45-52 (session.headers.update with X-MBX-APIKEY). All public endpoints via query() -> send_request() inherit this header.

Reproduction

1. Configure client with API key.
2. Call any public endpoint like ping() or klines().
3. Inspect request headers -- X-MBX-APIKEY is present.

Fix

Only include X-MBX-APIKEY header for limit_request() and sign_request() methods, not in session-level defaults.

Details

Finding ID: M-03
Severity: Medium

---

Researcher: Independent Security Researcher -- Mefai Security Team