Codeclimate key

ID

codeclimate_key

Severity

low

Vendor

Codeclimate

Family

API Token

Description

Code Climate provides automated code review for your apps, letting you fix quality and security issues before they hit production. It provides both an API to access the service data.

Security

Any hardcoded Codeclimate credential is a potential secret reported by this detector.

Accidentally checking-in the key to source control repositories could compromise your Codeclimate account.

Examples

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v2
      - name: Setup Node.js
        uses: actions/setup-node@v2
        with:
          node-version: '17.x'
      - run: make install
      - run: make lint
      - run: make test
      - name: Test & publish code coverage
        uses: paambaati/codeclimate-action@v3.0.0
        env:
          CC_TEST_REPORTER_ID: 9293ff84b57e017c1d3ffe32a1d3b437fad1fbb49c84b05f1e2795285352d9dc
        with:
          coverageCommand: make test-coverage
          debug: true

Mitigation / Fix

  1. Remove the API Key from the source code or committed configuration file.

  2. Follow your policy for handling leaked secrets, which typically require revoking the secret in the target system(s). Go to your dashboard to revoke the key.

  3. If under a git repository, you may remove unwanted files from the repository history using tools like git filter-repo or BFG Repo-Cleaner. You may follow the procedure listed here for GitHub.

You should consider any sensitive data in commits with secrets as compromised.

Remember that secrets may be removed from history in your projects, but not in other users' cloned or forked repositories.

Reference

https://developer.codeclimate.com