S01 Secret Exposure
What this means
SiteShadow flagged something that looks like a real credential (API key, token, password, private key) in source code, configuration, or logs.
Why it matters
- Fast compromise: leaked tokens are often immediately usable.
- Hard to contain: secrets spread into git history, build logs, crash reports, and chat.
- Blast radius: a single leaked secret can unlock production data, billing, or admin access.
Safer examples
1) Don't hardcode secrets — load them from the environment
import os
API_KEY = os.environ["API_KEY"]const apiKey = process.env.API_KEY;
if (!apiKey) throw new Error("Missing API_KEY");2) Don't log secrets — redact before logging
def redact(s: str) -> str:
return s[:4] + "…" if s else ""
logger.info("Using API key prefix=%s", redact(os.environ.get("API_KEY")))3) If a secret leaked, rotate it (don't "just delete the line")
- Rotate/revoke the credential at the provider.
- Remove it from history if it was committed (and assume it's compromised anyway).
- Replace with a secret manager or environment injection.
How SiteShadow detects it (high level)
- Known credential formats (e.g., common token prefixes, private key headers).
- Assignment patterns (e.g.,
api_key=...,token=...) with "real-looking" values. - Safety filters to reduce noise (ignores obvious placeholders/tests where possible).
References
- CWE-798: https://cwe.mitre.org/data/definitions/798.html
---