Secret scanning
Searching code, commits, build logs and other artifacts for credentials such as API keys, tokens and private keys, ideally blocking them before they are pushed and covering the full history. A detected secret must be revoked and rotated; deleting it from the repository is not enough.
- Also called
- secret scanner
- Defined in
- OWASP Secrets Management Cheat Sheet
Covered in
Contain a leaked secret, then investigate and clean up
Revoke an exposed API key, token or private key at its issuer before anything else, end the sessions it minted, check the provider's logs, then remove every copy and replace it with a credential that expires on its own.
Secrets management: storage, rotation and leaked-secret response
Follow one application credential from issuance through caching, rotation, revocation and restored backups, prove that its old value stops working, and respond correctly when a secret leaks.
Case study: Microsoft AI researchers' over-permissive SAS token (2023)
How an over-permissive Azure Storage SAS token in a public repository for AI models exposed internal Microsoft data in 2023, and how to scope, scan for and revoke signed URLs.
Practice: Insecure randomness lab: Generate unguessable API keys