Azure DevOps personal access token detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_SECRET_197
Category	Sensitive Tokens
Severity	MEDIUM
Framework	Git

Impact

An Azure DevOps Personal Access Token (PAT) is a long-lived credential used to authenticate programmatic access to the DevOps platform.

A leaked token grants an attacker the ability to impersonate the user, enabling them to access, modify, or delete code repositories, work items, and build pipelines, leading to significant supply chain and intellectual property risk.

How to Fix

To remediate exposed Source Control or CI/CD tokens:

1. Log in to the relevant system or provider.
2. Navigate to the settings menu to locate the exposed credential.
3. Revoke or delete the compromised token immediately.
4. Generate a new token if continued access is required.
5. Update any dependent systems or services with the new credential.

Next, remove the secret from your codebase:

1. Locate the exposed secret in your codebase.
2. Replace the hardcoded value with a secure variable or reference.

Finally, clean your version control history:

1. Permanently remove the sensitive data from your version control history to ensure it cannot be retrieved.