Zoho OAuth token detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_SECRET_385
Category	API Keys
Severity	HIGH
Framework	Git

Impact

A Zoho OAuth token (authorization code, access token, or refresh token) grants API access to the user's Zoho account on behalf of an integrated application, scoped by the granted OAuth scopes. All three artifact types share the same wire format 1000.<32hex>.<32hex>. Exposure allows an attacker to read or modify the user's Zoho data (Mail, CRM, Books, WorkDrive, etc.) within the granted scopes until the token is revoked or expires. Rotate immediately by revoking the token from the Zoho API Console and re-issuing via the OAuth flow.

How to Fix

Revoke the exposed Zoho OAuth token via the Zoho API Console (https://api-console.zoho.com) or by calling the Zoho OAuth revoke endpoint. Re-run the OAuth authorization flow to issue a fresh token, distribute it via a secrets manager, and purge the leaked value from git history.