Candidates the review stage examined and rejected, kept for transparency.
Credential access
highRefutedlow confidenceWooCommerce consumer key and secret are sent as URL query parameters to the user-configured WP_URL, which is allowed to be plain http://, so the credentials could travel in cleartext or appear in logs; this is the declared wrapped-service credential use, not a redirect to a third party.
consumer_key: cfg.key,
Why it was refuted
The consumer key is the wrapped WooCommerce service's own env API key, sent only to the user-configured store URL. This is the declared core capability and the documented auth method, not a redirect to a third party; the finding itself concedes this. Its only residual concern is possible http:// transport, which is a user configuration choice.
Credential access
highRefutedlow confidenceWC_CONSUMER_KEY/WC_CONSUMER_SECRET from the environment are placed in URL query parameters of requests to the user-configured WP_URL, which may be plain http://, so the credentials could be exposed in transit or in server logs; the destination is the declared store, so this is the wrapped service's normal auth.
consumer_secret: cfg.secret,
Why it was refuted
The consumer secret is the wrapped WooCommerce service's own env API credential, sent only to the user-configured store URL. This is the documented, declared auth mechanism for the service. It is not exfiltration to a third party, and the http:// concern is a configuration matter.
