See for yourself – run a scan on your code right now

Software and application development has changed significantly with the introduction of cloud-based services. Historically, developers write code on local desktops or laptops, meaning attackers needed to compromise the physical device. Further, this limited malicious actors’ ability to compromise the entire source code because no single developer had it stored on their device in its entirety. With DevOps models, everyone on the team has access to source code so they can make changes to development, testing, and production environments. 

While collaborating across cloud platforms delivers products to market faster, it creates new security risks. As developers write more code, manual code reviews and security checks no longer adequately respond to these risks. For example, developers sharing code snippets when collaborating in public repositories may not realize that they exposed a secret, like an API key. Further, misconfigurations in CI/CD pipelines can expose secrets in plaintext, meaning that anyone who accesses logs also access the secrets. 

With secret scanning, developers can identify and remove secrets to enhance security. 

What is Secret Scanning?

Secret scanning tools automate the detection and identification of potential secrets within source code or other file formats by using: 

  • Predefined regular expressions (regex): character sequences that match a text pattern
  • Scanning rules: custom rules based on format, expression before the secret, expression describing the characters after the secret, and any additional user-defined characters or expressions 

Examples of secrets include:

  • API keys
  • Authentication tokens
  • Credentials
  • Private encryption keys
  • Digital certificates

Where to scan for secrets

To ensure comprehensive security, developers and DevOps teams should scan all potential risky locations across their codebase. 

Source code

While hardcoding secrets isn’t new, cloud-native applications and environments introduce significant risks. Developers may insert a block of code containing a secret to use when testing the app locally then forget to remove it. For example, a Python application’s source code may incorporate a database’s password so that it can easily connect with it. 

Configuration files

An application’s configuration files may store secrets stored locally that later get uploaded to the cloud. For example, a global git configuration file might store credentials when a developer uses the credential.helper

Additionally, file paths within configuration files identify where a file is located within the larger application’s file structure. Since they may trace back to internal or external resources, they can accidentally expose secrets.  

Environment variables

An application’s environment variables often store secrets which are easier to modify between deploys without impacting the source code. Since environment variables often remain in plaintext, this can lead to data leakage. For example, an environment variable may store an API key for a payment gateway. 

Container images

Docker containers can leak secrets when developers configure them with unencrypted environment variables, making them visible in plaintext. For example, a Docker container might obtain a root password to a MySQL database so that the software within the container can use the password. 

DevOps stack

The tools and services that the team uses can expose secrets. Since vendors often have different native secrets capabilities, the team may not be able to centrally and securely store, provide, and grant access to secrets. For example, the DevOps pipeline relies on machine-to-machine interactions which can expose secure shell (SSH) keys when technologies communicate with each other. 

When to scan for secrets

Since various parts of the development process can expose secrets, scanning for them needs to be implemented across build and runtime. 

Scanning in build

Secret scanning across the build process should help detect leaks in:

  • Files
  • Dependencies
  • Build scripts
  • Build configuration files
  • Package managers

Scanning at runtime

During the runtime phase, your application’s active request processing and code execution can expose secrets through:

  • Logging
  • Error messages
  • Connections to external services and databases
  • Authentication and authorization mechanisms

Qwiet AI: Build Secret Scanning into DevOps 

With Qwiet AI’s preZero platform, you get the depth of secret scanning necessary to protect your application. With our platform, you can identify secrets present in your source code and all included properties files. PreZero enables you to identify hard-coded values like username/password combinations and sensitive information like phone numbers and physical addresses. 

Using Qwiet AI, you can incorporate all vulnerability and secret scanning in one location for a comprehensive approach that shifts all application security left. 

Take our preZero platform for a free spin to see how Qwiet AI can help you identify shadow code. 

About ShiftLeft

ShiftLeft empowers developers and AppSec teams to dramatically reduce risk by quickly finding and fixing the vulnerabilities most likely to reach their applications and ignoring reported vulnerabilities that pose little risk. Industry-leading accuracy allows developers to focus on security fixes that matter and improve code velocity while enabling AppSec engineers to shift security left.

A unified code security platform, ShiftLeft CORE scans for attack context across custom code, APIs, OSS, containers, internal microservices, and first-party business logic by combining results of the company’s and Intelligent Software Composition Analysis (SCA). Using its unique graph database that combines code attributes and analyzes actual attack paths based on real application architecture, ShiftLeft then provides detailed guidance on risk remediation within existing development workflows and tooling. Teams that use ShiftLeft ship more secure code, faster. Backed by SYN Ventures, Bain Capital Ventures, Blackstone, Mayfield, Thomvest Ventures, and SineWave Ventures, ShiftLeft is based in Santa Clara, California. For information, visit: www.shiftleft.io.

Share

See for yourself – run a scan on your code right now