FixVibe
Covered by FixVibehigh

. API Lyklaleka: Váði og tilbúgving í nútímans vevforritum ZXCVFIXVIBESEND ZXCVFIXVIBESEG1. Lær vandan við at leka API lyklar í frontend kotu og goymslusøgu, og hvussu tú rætt rættar útsett loyndarmál. ZXCVFIXVIBESEND ZXCVFIXVIBESEG2. Harðkodaðar loyndarmál í frontend-kotu ella goymslusøgu loyva álopsmonnum at gera seg inn á tænastur, fáa atgongd til privatar dátur og fáa kostnað. Henda greinin fevnir um vandan við loyniligum lekum og neyðugu stigini til ruddingar og fyribyrging. ZXCVFIXVIBESEND ZXCVFIXVIBESEG3. ## Ávirkan ZXCVFIXVIBESEND ZXCVFIXVIBESEG4. Lekandi loyndarmál sum ZXCVFIXVIBETOKEN2ZXCV lyklar, tokens ella prógv kunnu føra til ólógliga atgongd til viðkvæmar dátur, tænastueyðkenni og munandi fíggjarligt tap orsakað av tilfeingismisnýtslu API. Tá ein loyndarmál er bundin til eitt alment goymslustað ella bundið saman í eitt frontend forrit, skal tað metast sum kompromitterað ZXCVFIXVIBETOKEN1ZXCV. ZXCVFIXVIBESEND ZXCVFIXVIBESEG5. ## Rótorsøk ZXCVFIXVIBESEND ZXCVFIXVIBESEG6. Rótorsøkin er, at viðkvæm trúnaðarupplýsingar eru tiknar inn beinleiðis í keldukotu ella uppsetingarfílur, sum síðani eru bundnar at stýra útgávuni ella verða vístar til kundan ZXCVFIXVIBETOKEN1ZXCV. Forritarar ofta harðkoda lyklar fyri at vera lættari undir menningini ella av tilvild hava API fílur við í teirra commits ZXCVFIXVIBETOKEN2ZXCV. ZXCVFIXVIBESEND ZXCVFIXVIBESEG7. ## Betongviðgerðir ZXCVFIXVIBESEND ZXCVFIXVIBESEG8. 1. **Skift kompromitteraðum loyndarmálum:** Um ein loyndarmál er lektur, skal hann takast aftur og skiftast út beinanvegin. Bara at strika loyndarmálið úr verandi útgávu av kodini er ikki nóg mikið, tí tað er eftir í útgávustýringarsøguni APIZXCVFIXVIBETOKEN1ZXCV. ZXCVFIXVIBESEND ZXCVFIXVIBESEG9. 2. **Brúka umhvørvisbreytir:** Goym loyndarmál í umhvørvisbreytum heldur enn at harðkoda tær. Tryggja tær, at API fílur verða lagdar afturat ZXCVFIXVIBETOKEN1ZXCV fyri at forða fyri tilvildarligum fremja ZXCVFIXVIBETOKEN2ZXCV. ZXCVFIXVIBESEND ZXCVFIXVIBESEG10 3. **Implementera loyniliga stýring:** Brúka dedikerað loynilig stýringartól ella hjóltænastur til at sprayta rættar upplýsingar inn í forritaumhvørvið við koyritíð API. ZXCVFIXVIBESEND ZXCVFIXVIBESEG11 4. **Reinsa goymslusøgu:** Um ein loyndarmál varð bundin av Git, brúka tól sum API ella BFG Repo-Cleaner til at strika viðkvæmu dáturnar frá øllum greinum og merkjum í goymslusøguni ZXCVFIXVIXCVBETOKEN1Z varandi. ZXCVFIXVIBESEND ZXCVFIXVIBESEG12 ## Hvussu API roynir fyri tí ZXCVFIXVIBESEND ZXCVFIXVIBESEG13 ZXCVFIXVIBETOKEN1ZXCV inniheldur nú hetta í beinleiðis skanningum. Passivt API heinta JavaScript-bingjur av sama uppruna og passar til kend ZXCVFIXVIBETOKEN4ZXCV lykil, token og prógvmynstur við entropi og staðhaldaraportrum. Viðkomandi beinleiðis kanningar kanna kagagoymslu, keldukort, auth og ZXCVFIXVIBETOKEN5ZXCV klientbingjur, og ZXCVFIXVIBETOKEN3ZXCV repo keldumynstur. Git søgu umskriving er framvegis eitt tilbúgvingarstig; Beinleiðis frásøgnin hjá ZXCVFIXVIBETOKEN2ZXCV snýr seg um loyndarmál, sum eru til staðar í sendum ognum, kagagoymslu og aktuellum repo-innihaldi.

Hard-coded secrets in frontend code or repository history allow attackers to impersonate services, access private data, and incur costs. This article covers the risks of secret leakage and the necessary steps for cleanup and prevention.

CWE-798

Impact

Leaking secrets such as API keys, tokens, or credentials can lead to unauthorized access to sensitive data, service impersonation, and significant financial loss due to resource abuse [S1]. Once a secret is committed to a public repository or bundled into a frontend application, it should be considered compromised [S1].

Root Cause

The root cause is the inclusion of sensitive credentials directly in source code or configuration files that are subsequently committed to version control or served to the client [S1]. Developers often hard-code keys for convenience during development or accidentally include .env files in their commits [S1].

Concrete Fixes

  • Rotate Compromised Secrets: If a secret is leaked, it must be revoked and replaced immediately. Simply removing the secret from the current version of the code is insufficient because it remains in the version control history [S1][S2].
  • Use Environment Variables: Store secrets in environment variables rather than hard-coding them. Ensure that .env files are added to .gitignore to prevent accidental commits [S1].
  • Implement Secret Management: Use dedicated secret management tools or vault services to inject credentials into the application environment at runtime [S1].
  • Purge Repository History: If a secret was committed to Git, use tools like git-filter-repo or the BFG Repo-Cleaner to permanently remove the sensitive data from all branches and tags in the repository history [S2].

How FixVibe tests for it

FixVibe now includes this in live scans. Passive secrets.js-bundle-sweep downloads same-origin JavaScript bundles and matches known API key, token, and credential patterns with entropy and placeholder gates. Related live checks inspect browser storage, source maps, auth and BaaS client bundles, and GitHub repo source patterns. Git history rewriting remains a remediation step; FixVibe's live coverage focuses on secrets present in shipped assets, browser storage, and current repo contents.