Leaked secret keys

A secret key that ships in a page or a script file belongs to everyone who opens the site.

What it is

Every file your site serves is a file a visitor can read. Keys for services such as OpenAI, Stripe, GitHub, AWS, SendGrid and Slack have recognisable shapes, and a key of that shape inside a public script is a leaked key. Webhook addresses and database connection strings with a password count too, because they work as keys.

Why it matters

Anyone who finds the key can use your account with the access the key carries. For an AI provider key that means your bill, for Stripe it means your customers and your money, for a connection string it means your database. Bots scan public sites for these shapes around the clock, so a leaked key is usually used within hours. Tenty rates the finding critical or high, and lower when the value looks like a sample on a docs page.

How Tenty checks it

Tenty reads this from the page and the script files every visitor receives. The check runs on every scan, and the finding names the place where the value appears. Tenty compares text against the patterns of about 25 providers and reads the context around a match to tell a live key from an example. A key shaped string printed as visible text gets its own kind, key-shown-as-text, because that is usually a sample.

How to fix it

1. Rotate the key at the provider first. A key that was public for one minute counts as public. 2. Move the call that needs the key to your server, and keep the key in the environment of the server. 3. Search your repository and build output for the old value, and remove it from git history if it was committed. 4. For providers that offer it, restrict the new key to the actions and addresses it needs.

How to reproduce

Search the file named in the finding for the start of the key:

curl -sS 'https://YOUR-APP/assets/app.js' | grep -o 'sk_live_[A-Za-z0-9]*'

Use the file address from the finding and the prefix of your own key. A match means the key is public.