Loading…
9
I thought secrets in env vars were fine until an old S3 key sat in our CI logs for 9 days
I used to think keeping API keys in environment variables was good enough, but then a junior dev ran a debug print on our pipeline and our AWS key ended up sitting in plain text in the build logs for 9 days. It took me almost two full days to figure out where it leaked from, and another few hours to rotate everything and make sure nothing weird hit our S3 buckets. What finally changed my mind was watching a coworker grep through 40,000 log lines by hand while I sat there feeling dumb. Now I push for short lived tokens from our vault setup instead of long lived keys. Has anyone else had a leak like this, and how do you catch it faster than just waiting for a scary bill?
1 comments
Log in to join the discussion
Log In1 Comment
west.jade23d ago
Been there, except my version is leaving a database password in a screenshot of my terminal during a screen share. Now I run gitleaks in our pipeline so the robot catches my dumb mistakes before the whole company does.
6