T0189 - Secrets in configuration files

M1120

Mitigation

Mitigation Store credentials in vault Sensitive data like credentials and API tokens should not be stored directly in code.

Modern applications talk to many third-party APIs, SaaS solutions and other dependecies. This integration usually requires an API token, username & password credential or other similar variable. Sometimes these sensitive credentials include database host strings or hostnames. All of these credentials should not be stored directly in code. Software engineers often don't understand the consequences of embedding these credentials in code. This is especially true for Javascript applications that run client side as these credentials are often visible by inspecting the Javascript files running in the local browser

M1890

Mitigation

Detection Encrypt secrets Sensitive information stored in configuration files should be encrypted to protect it from unauthorized access.

Detection Encrypt secrets Sensitive information stored in configuration files should be encrypted to protect it from unauthorized access.

D1120

Detection

Detection Implement source code scanning for credentials and tokens Set up monitoring of reported issues based on regular credentials scanning results.

Scan web applications for embedded secrets and credentials. It is particularily important after deployment to a web endpoint that you scan that newly deployed app for secrets, credentials and other sensitive data.