Nowadays, it is very common for people to commit secrets into repositories or even to store them in code by accident. There are many types of secrets, including keys, passwords, API tokens, and other sensitive information. If anyone had access to these secrets, they could use them maliciously. When secrets are exposed to the public, they are compromised and have to be replaced, which can be very expensive. The Proactive DLP now has the ability to help prevent secrets from being exposed. Using the Secret Detection feature, you will be able to scan your files for secrets they might contain.
Supported file types
- Text based files, e.g: source code, configuration files.
Supported Secrets
Amazon Web Services (AWS)
- AWS Access Key ID
- AWS Secret Access Key
- AWS Temporary Access Key ID
- AWS Session Token
- AWS STS Token
Microsoft Azure
- Azure SAS Signature
- Azure Access Key
- Azure Access Token
- Azure Tenant ID
- Azure Client ID
- Azure Client Secret
- Azure Username
- Azure Password
Google Cloud Platform (GCP)
- Google Cloud Api Key
- Google Cloud Key (We search for the base64 encoded version of the key as well)
- Google OAuth Client ID (We search for reversed client ID as well)
- Google OAuth Client Secret
Private keys (PEM, PPK)
IBM keys
- IBM Cloud key
- IBM COS HMAC Credentials
- IBM API Connect Credentials
Generic passwords
Generic API tokens
PostgreSQL credentials
MYSQL credentials
Enabling Secret Detection
Policies > Workflow rules > Workflow name > Proactive DLP > Detect secret
Example
The following examples do not represent actual secrets.
| Example | |
|---|---|
| 'AWS_ACCESS_KEY_ID' = 'AKIAIOSFODNN7EXAMPLE' | Amazon Web Services |
| 'aws_secret_ access_key' = ' | |
| 'AWS Temporary Access Key ID' = 'ASIAIOSFODNN7EXAMPLE' | |
| 'AWS Session Token' = ' | |
| 'Azure SAS Signature' = ' | Microsoft Azure |
| 'Azure Access Key' = ' | |
| 'Azure Access Token' = ' | |
| 'Azure Tenant ID' = ' | |
| 'Azure Client ID' = ' | |
| 'Azure Client Secret' = ' | |
| 'Azure Username' = 'john.doe@example.com' | |
| 'Azure Password' = 'Azure$tr0ngP@ssw0rd123!' | |
| 'Google Cloud API Key' = ' | Google Cloud Platform |
| 'Google OAuth Client ID' = ' | |
| 'Google OAuth Client Secret' = 'Xyz1A2B3C4d5e6F7g8H9i0' | |
-----BEGIN RSA PRIVATE KEY----- M -----END RSA PRIVATE KEY----- | Private keys (PEM, PPK) |
| 'IBM Cloud API Key' = ' | IBM keys |
| ' IBM COS HMAC Access Key ID' = ' | |
| 'IBM API Connect Client Secret' = ' | |
| Host: db.example.com Port: 5432 Database: example _ db Username: example _ user Password: P@ssw0rd!123 | PostgreSQL credentials |
| Host: db.example.com Port: 5432 Database: example _ db Username: example _ user Password: P@ssw0rd!123 | MYSQL credentials |
| 'Generic Password' = 'S3cureP@55w0rd!2023' | Generic passwords |
| 'Generic API Key' = ' | Generic API tokens |