Indonesian Government

Discovering Hard-Coded Credentials on KOMDIGI's Website

June 2026 — Vulnerability Disclosure Program

KOMDIGI-CSIRT, which stands for CSIRT Kementrian Komunikasi dan Digital Republik Indonesia (Computer Security Incident Response Team of the Ministry of Communication and Digital Affairs of the Republic of Indonesia), runs an official Vulnerability Disclosure Program (VDP) here. Successful researchers are recognized with a Certificate of Appreciation and a spot on their public leaderboard, where rankings are determined by individual points collected.

Lately, I noticed that many of my Indonesian connections on LinkedIn who actively hunt for bugs have been posting certificates earned by discovering and submitting valid vulnerabilities to KOMDIGI-CSIRT. Spurred by this, I decided to try my hand at it. During registration, I noticed that certain profile fields strictly required Indonesian-specific information, such as local phone formats and cities. Since I didn't possess these, I skipped what I could and selected placeholder options for the rest, just enough to successfully provision a valid account.

My first round of enumerating and inspecting subdomains didn't yield immediate results. The perimeter looked fairly secure, so I decided to slow down and inspect the subdomains in closer detail. Eventually, I stumbled across a subdomain protected by a Cloudflare Turnstile human verification step. Initially, I didn't think much of it, but I dove into the browser's DevTools anyway to map out how the site behaved. I then pulled up the FindSomething browser extension to check for any exposed secrets or interesting patterns.

To my surprise, the tool instantly flagged an environment variable: VITE_TURNSTILE_SECRET_KEY: REDACTED. Realizing this could be significant, I copied the key and ran a global search across the source files in DevTools. Sure enough, the secret key was hardcoded directly into the client-side JavaScript.

At this point, I wanted to ensure this would actually qualify as a valid vulnerability, so I did some quick research. Cloudflare’s official documentation explicitly warns against exposing secret keys in client-side code. To understand why, we have to look at how Turnstile protects forms from bots: a front-end JavaScript widget challenges the visitor's browser and generates a token. The backend server is then supposed to securely transmit this token to Cloudflare to confirm its validity. The secret key is a private credential reserved strictly for that server-side validation. Exposing it defeats the integrity of the challenge.

With the official documentation validating my instincts, I packaged my findings and reported the flaw to KOMDIGI-CSIRT on 8 May 2026 at 9:00 AM. Less than two weeks later, I checked back on the status of my submission. The report was processed by the KOMDIGI helpdesk on 19 May 2026 at 2:40 PM, and was marked as valid just ten minutes later. Finally, on 4 June 2026, I received my official PDF certificate.