Generic Secret

ID

generic_secret

Severity

info

Vendor

-

Family

Generic secret

Description

Detects generic secrets by matching strings with a given length and a proper entropy.

Examples

2024-04-18 07:46:30 INFO  i.x.m.clazz.MyClazz - Completed execution for YXNk-mZZm-1234-HARDc0ded-YXNk-mZ

Mitigation / Fix

  1. Audit that the reported secret is a real API key.

  2. Remove the hardcoded API key from the source code or committed configuration file.

  3. Follow your policy for handling leaked secrets, which typically require revoking the key in the target system(s).

  4. If under a git repository, you may remove unwanted files from the repository history using tools like git filter-repo or BFG Repo-Cleaner. You may follow the procedure listed here for GitHub.