HashiCorp Vault token detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_SECRET_199
Category	Sensitive Tokens
Severity	HIGH
Framework	Git

Impact

A HashiCorp Vault Token is the primary credential for accessing and managing all secrets stored within the Vault server.

Exposure of this token, especially a highly-privileged one, is an Extremely Critical Risk, resulting in a cascading security failure where an attacker gains access to all secrets (e.g., database passwords, other cloud keys) the token is authorized for.

How to Fix

To remediate exposed Cloud & Infrastructure credentials:

1. Log in to your cloud provider's console.
2. Locate the identity or service account associated with the compromised credentials.
3. Revoke or deactivate the compromised keys immediately.
4. Generate a new set of credentials.
5. Update your environment variables, secrets manager, or pipelines with the new values.

Next, remove the secret from your codebase:

1. Locate the exposed secret in your codebase.
2. Replace the hardcoded value with a secure variable or reference.

Finally, clean your version control history:

1. Permanently remove the sensitive data from your version control history to ensure it cannot be retrieved.

Warning: Revoking infrastructure keys may cause immediate downtime. Ensure you have identified all dependent services before revoking.