Potential keys or passwords are visible/hardcoded
Secrets such as API keys, tokens and passwords should be kept in a safe place, and moreover - not be plainly visible or hardcoded.
As secrets hold access rights to a multitude of services, data stores, file storage, and more, it is a high-profile and sought-after piece of sensitive information in hacker communities.
Even if secrets are RBAC or minimal-access based, once these are exposed, you still have a tiring job of tracing, locating, rotating, and observing the implication of rotating such secrets. Keeping them stored safely and securely minimizes your productivity loss.
Problem
API keys, tokens, or passwords are hardcoded or exposed in configuration files, infrastructure code, or business services.
Fix
Infrastructure
- Use a cloud-native secret store, such as AWS Secrets Manager
- Use a dedicated vault product, such as:
- Removing hardcoded secret/password from the source is not drawing it from the repository history. We strongly recommend changing the secret/password that was exposed.
Architecture
See
Updated about 1 year ago