IBM COS HMAC credentials detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_SECRET_355
Category	Secrets
Severity	LOW
Framework	Git

Impact

The IBM Cloud Object Storage (COS) HMAC credential provides S3-compatible access.

Exposure is a Critical Risk allowing an attacker to interact with storage buckets, reading sensitive files, deleting backups, or hosting malware using standard S3 tools.

How to Fix

To remediate exposed Cloud & Infrastructure credentials:

1. Log in to your cloud provider's console.
2. Locate the identity or service account associated with the compromised credentials.
3. Revoke or deactivate the compromised keys immediately.
4. Generate a new set of credentials.
5. Update your environment variables, secrets manager, or pipelines with the new values.

Next, remove the secret from your codebase:

1. Locate the exposed secret in your codebase.
2. Replace the hardcoded value with a secure variable or reference.

Finally, clean your version control history:

1. Permanently remove the sensitive data from your version control history to ensure it cannot be retrieved.

Warning: Revoking infrastructure keys may cause immediate downtime. Ensure you have identified all dependent services before revoking.