Question 1

What types of secrets are commonly leaked in source code?

Accepted Answer

Common leaked secrets include AWS access keys and secret keys, GitHub personal access tokens, database connection strings with passwords, API keys for services like Stripe, Twilio, and SendGrid, OAuth client secrets, private SSH keys, JWT signing secrets, and environment-specific credentials. These often end up in public repositories, CI/CD configs, Docker images, and client-side JavaScript bundles.

Question 2

How can organizations prevent secret leaks?

Accepted Answer

Prevention strategies include using secret scanning tools like GitLeaks, TruffleHog, or GitHub's built-in secret scanning in CI pipelines. Store secrets in dedicated vaults (HashiCorp Vault, AWS Secrets Manager) or environment variables. Use pre-commit hooks to block commits containing secrets, rotate credentials regularly, and enforce the principle of least privilege for all tokens and API keys.

Token Spotter

How to play

Frequently Asked Questions