Loading…
15
Just realized my staging environment had live prod keys in it for 4 months
I ran a quick scan on our staging box last Monday and found an AWS key with full admin access sitting in a .env file that got committed back in March. Nobody caught it because staging never shows up in our main dashboards and the key was tied to a service account nobody watches. What got me was that the key still worked, so for 4 months anyone with repo access could have wiped our S3 buckets and we would have had zero alert. I rotated it same day and turned on a git hook that blocks .env commits, but now I'm second guessing every other config file in that repo. We scanned 23 repos after that and found 2 more old tokens that should have died last year. Has anyone found a good way to catch stale creds in non prod branches without slowing down every push?
0 comments
Log in to join the discussion
Log In0 Comments
No comments yet
Be the first to share your thoughts on this discussion.