Secrets detected in pipeline's console output

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_84
Category	Credential Hygiene
Severity	MEDIUM

Impact

Secrets were exposed in pipeline build logs. Exposed secrets in log files can be used by an attacker, who has gained access to the system, to move laterally within the organization. This often happens when credentials are not properly masked or protected using the platform's built-in features, or when they are printed in a way that bypasses secret detection capabilities.

Recommended Solution - Buildtime

When exposed credentials are found it is recommended to:

• Rotate all exposed credentials.
• Make sure credentials are accessed using the Credential Binding plugin.
• The Credential Binding masking feature has limitations, hence some exposed credentials should be resolved by modifying the Jenkins file to prevent exposure.
• Consider using the Mask Passwords plugin to manually configure secrets that should be masked.