Software and application development has changed significantly with the introduction of cloud-based services. Historically, developers write code on local desktops or laptops, meaning attackers needed to compromise the physical device. Further, this limited malicious actors’ ability to compromise the entire source code because no single developer had it stored on their device in its entirety. With DevOps models, everyone on the team has access to source code so they can make changes to development, testing, and production environments.
While collaborating across cloud platforms delivers products to market faster, it creates new security risks. As developers write more code, manual code reviews and security checks no longer adequately respond to these risks. For example, developers sharing code snippets when collaborating in public repositories may not realize that they exposed a secret, like an API key. Further, misconfigurations in CI/CD pipelines can expose secrets in plaintext, meaning that anyone who accesses logs also access the secrets.
With secret scanning, developers can identify and remove secrets to enhance security.
What is Secret Scanning?
Secret scanning tools automate the detection and identification of potential secrets within source code or other file formats by using:
- Predefined regular expressions (regex): character sequences that match a text pattern
- Scanning rules: custom rules based on format, expression before the secret, expression describing the characters after the secret, and any additional user-defined characters or expressions
Examples of secrets include:
- API keys
- Authentication tokens
- Credentials
- Private encryption keys
- Digital certificates
Where to scan for secrets
To ensure comprehensive security, developers and DevOps teams should scan all potential risky locations across their codebase.
Source code
While hardcoding secrets isn’t new, cloud-native applications and environments introduce significant risks. Developers may insert a block of code containing a secret to use when testing the app locally then forget to remove it. For example, a Python application’s source code may incorporate a database’s password so that it can easily connect with it.
Configuration files
An application’s configuration files may store secrets stored locally that later get uploaded to the cloud. For example, a global git configuration file might store credentials when a developer uses the credential.helper.
Additionally, file paths within configuration files identify where a file is located within the larger application’s file structure. Since they may trace back to internal or external resources, they can accidentally expose secrets.
Environment variables
An application’s environment variables often store secrets which are easier to modify between deploys without impacting the source code. Since environment variables often remain in plaintext, this can lead to data leakage. For example, an environment variable may store an API key for a payment gateway.
Container images
Docker containers can leak secrets when developers configure them with unencrypted environment variables, making them visible in plaintext. For example, a Docker container might obtain a root password to a MySQL database so that the software within the container can use the password.
DevOps stack
The tools and services that the team uses can expose secrets. Since vendors often have different native secrets capabilities, the team may not be able to centrally and securely store, provide, and grant access to secrets. For example, the DevOps pipeline relies on machine-to-machine interactions which can expose secure shell (SSH) keys when technologies communicate with each other.
When to scan for secrets
Since various parts of the development process can expose secrets, scanning for them needs to be implemented across build and runtime.
Scanning in build
Secret scanning across the build process should help detect leaks in:
- Files
- Dependencies
- Build scripts
- Build configuration files
- Package managers
Scanning at runtime
During the runtime phase, your application’s active request processing and code execution can expose secrets through:
- Logging
- Error messages
- Connections to external services and databases
- Authentication and authorization mechanisms
Qwiet AI: Build Secret Scanning into DevOps
With Qwiet AI’s preZero platform, you get the depth of secret scanning necessary to protect your application. With our platform, you can identify secrets present in your source code and all included properties files. PreZero enables you to identify hard-coded values like username/password combinations and sensitive information like phone numbers and physical addresses.
Using Qwiet AI, you can incorporate all vulnerability and secret scanning in one location for a comprehensive approach that shifts all application security left.
Take our preZero platform for a free spin to see how Qwiet AI can help you identify shadow code.