Glossary · Security
Secret Leak
The accidental exposure of a credential, API key, private key or password in source code, a git repository or a public facing file.
Browse all definitionsIn detail
A secret leak (or credential leak) occurs when a sensitive value such as an API key, database password, private certificate, signing secret or OAuth client secret ends up in a location where it is accessible to unintended parties. Common vectors include committing a .env file to a public git repository, including secrets in client side JavaScript bundles, shipping source maps that contain secrets, logging secrets to application logs, and hardcoding secrets in configuration files. Once someone commits a secret to a public repository, scanners like TruffleHog and GitHub's secret scanning detect it within seconds. Rotation and revocation is the only remedy.
Sources & further reading
Check the source, not just the summary
- OWASP Secrets Management Cheat Sheetcheatsheetseries.owasp.org
Apply the definition
Want to talk through how this applies to your business?
Start with the decision in front of you. We will help map the fit.