Axur offers a specialized solution for detecting exposed code keys (tokens, passwords, critical configuration files) in public codes or commits on GitHub, with mentions of the contracting company's domains. This article provides insights into how this functionality works to protect our clients' essential information.
What does the offering do?
Identifies exposed code keys that may contain critical information about the client.
Utilizes information such as domain.com.br and br.com.domain to search for exposed data.
Presents the exact line where the key was found (clicking on the occurrence takes you directly to the line in the code on GitHub).
Indicates the specific type of code key found.
Detects code keys in new commits.
What the offering does not do?
Other Git Platforms:
Does not detect code keys on other Git platforms such as GitLab and Bitbucket.
GitHub Commit History:
Does not detect code keys in commit histories (before the creation of collections) on GitHub.
Large Repositories:
Does not detect code keys in repositories larger than 35 MB compressed and 100 MB uncompressed.
Inactive Repositories:
Does not detect code keys in repositories without commits in the last 365 days.
Risk Score:
Does not provide a risk score associated with the exposed key found in repositories with mentions of the client's domains (tickets have a risk level from 0 to 50, but keys do not have individual risk levels).
ZIP Files:
Does not detect code keys within .ZIP files.
What is an infringement on GitHub?
We have an article detailing GitHub policies, access GitHub — What is an infringement?
Manual Creation of Tickets in the Code secret exposure Offering
If there is a need to manually create a ticket in the platform for reporting Code secret exposure, the process is similar to other offerings and can be consulted in the “Manual Addition of Tickets” article.
Attention! Before creating a ticket, search the platform to identify possible tickets already created for the case. For more information, consult the “Manual Ticket Search” article.
Access the Data Leakage section.
On the right corner, click on the “+ Add Ticket” button.
Select the asset related to the fraud.
Choose the ticket type “Code secret exposure”
Insert the URL. If there is more than one URL, select the “Create more than one ticket” option.
Click on the “+ Add.”
You have successfully created the code secret exposure. \o/
Attention! After creating the Code secret exposure ticket, it is mandatory to include evidence showing which key was exposed in the inserted URL. For more information on how to add evidence to a ticket, refer to the article "How to add evidence to tickets."
If you have any questions, feel free to reach out at [email protected] 😊