Secrets can grant access to data, impact production operations, access third party systems down the software supply chain, and introduce a reputational risk. They can be found in source code, production and CI/CD logs, Docker images, Slack channels, or even on a random shared file. Given how powerful secrets are, it is critical that developer security tools provide secret detection for free across public and private repos.

This post is written in response to GitHub’s security alert from April 15th about abusing OAuth app integrations, and it includes the technical details to identify and prevent such attacks. GitHub application exploitation is yet another software supply chain attack vector to compromise multiple organizations rapidly, and there is no code dependency or hardened CI/CD pipeline that will mitigate this risk or provide sufficient context to such attack.

The threat of cyber-attacks against countries opposing the Ukraine invasion increases, putting targets on the backs of organizations in the west. White House and CISA declare US enterprises at risk – imploring companies to secure their infrastructure. Adding to an already high-risk environment, Immediate action is needed to harden your company's production infrastructure and software supply chain.