Coveo API Key detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_SECRET_383
Category	API Keys
Severity	HIGH
Framework	Git

Impact

A Coveo API key grants programmatic access to a Coveo organization, including search, indexing, source management, and administrative operations depending on the privileges assigned to the key. If leaked, an attacker can query or exfiltrate indexed enterprise content, push or delete documents from sources, and modify organization configuration, leading to data exposure and search-service compromise.

How to Fix

Revoke the exposed Coveo API key in the Coveo Administration Console and generate a new one with least-privilege scope. Update all consumers to use the new key via a secrets manager or environment variables, and purge the leaked value from git history.