fix: the api key used to authenticate against extern... in registro.js

[anupamme]

Summary

Fix critical severity security issue in lib/waCmd/ALEATORIO/registro.js.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	lib/waCmd/ALEATORIO/registro.js:1
Assessment	Likely exploitable
Chain Complexity	2-step

Description: The API key used to authenticate against external services is stored in global.db.nk and passed directly into URL query strings. The key is also partially embedded in obfuscated string literals within lib/gpEventos.js. This exposes the key in source code, HTTP logs, and network traffic.

Evidence

Exploitation scenario: An attacker with read access to the source repository can decode the obfuscated strings to extract the API key pattern.

Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a web service - vulnerabilities in request handlers are directly exploitable by remote attackers.

Changes

• lib/waCmd/ALEATORIO/registro.js

Behavior Preservation

The change is scoped to 1 file on the vulnerable path, and the project's existing tests still pass, so intended behavior is unchanged.

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security