Hashicorp Vault AppRole Authentication detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_SECRET_340
Category	Secrets
Severity	LOW
Framework	Git

Impact

The HashiCorp Vault AppRole (RoleID/SecretID) is the standard method for machine authentication.

Exposure is a Critical Risk enabling an attacker to impersonate a trusted workload and request every secret (DB passwords, API keys) that the specific AppRole is authorized to access.

How to Fix

To remediate exposed Cloud & Infrastructure credentials:

1. Log in to your cloud provider's console.
2. Locate the identity or service account associated with the compromised credentials.
3. Revoke or deactivate the compromised keys immediately.
4. Generate a new set of credentials.
5. Update your environment variables, secrets manager, or pipelines with the new values.

Next, remove the secret from your codebase:

1. Locate the exposed secret in your codebase.
2. Replace the hardcoded value with a secure variable or reference.

Finally, clean your version control history:

1. Permanently remove the sensitive data from your version control history to ensure it cannot be retrieved.

Warning: Revoking infrastructure keys may cause immediate downtime. Ensure you have identified all dependent services before revoking.