ishangsf/rspec
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
rspec/rules/S6723/secrets/rule.adoc

51 lines
1.2 KiB
Plaintext
Raw Normal View History

Create rule S6723(secrets): Mailgun API keys should not be disclosed (#2948) You can preview this rule [here](https://sonarsource.github.io/rspec/#/rspec/S6723/secrets) (updated a few minutes after each push). ## Review A dedicated reviewer checked the rule description successfully for: - [ ] logical errors and incorrect information - [ ] information gaps and missing content - [ ] text style and tone - [ ] PR summary and labels follow [the guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule) --------- Co-authored-by: loris-s-sonarsource <loris-s-sonarsource@users.noreply.github.com> Co-authored-by: Loris Sierra <loris.sierra@sonarsource.com>
2023-08-29 15:38:39 +02:00
include::../../../shared_content/secrets/description.adoc[]
== Why is this an issue?
include::../../../shared_content/secrets/rationale.adoc[]
=== What is the potential impact?
add daniel's suggestion
2023-08-31 15:45:47 +02:00
Mailgun API keys provide complete control over the Mailgun account and allow
Create rule S6723(secrets): Mailgun API keys should not be disclosed (#2948) You can preview this rule [here](https://sonarsource.github.io/rspec/#/rspec/S6723/secrets) (updated a few minutes after each push). ## Review A dedicated reviewer checked the rule description successfully for: - [ ] logical errors and incorrect information - [ ] information gaps and missing content - [ ] text style and tone - [ ] PR summary and labels follow [the guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule) --------- Co-authored-by: loris-s-sonarsource <loris-s-sonarsource@users.noreply.github.com> Co-authored-by: Loris Sierra <loris.sierra@sonarsource.com>
2023-08-29 15:38:39 +02:00
sending bulk emails.
Below are some real-world scenarios that illustrate some impacts of an attacker
exploiting the secret.
include::../../../shared_content/secrets/impact/personal_data_compromise.adoc[]
:secret_type: secret
include::../../../shared_content/secrets/impact/phishing.adoc[]
include::../../../shared_content/secrets/impact/malware_distribution.adoc[]
include::../../../shared_content/secrets/impact/suspicious_activities_termination.adoc[]
== How to fix it
include::../../../shared_content/secrets/fix/revoke.adoc[]
include::../../../shared_content/secrets/fix/vault.adoc[]
=== Code examples
Modify S6723(secrets): Improve code sample (#3126) ## Review A dedicated reviewer checked the rule description successfully for: - [ ] logical errors and incorrect information - [ ] information gaps and missing content - [ ] text style and tone - [ ] PR summary and labels follow [the guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-09-22 14:17:57 +02:00
:example_secret: key-9392bf4edd483c111748f422750442fe
Create rule S6723(secrets): Mailgun API keys should not be disclosed (#2948) You can preview this rule [here](https://sonarsource.github.io/rspec/#/rspec/S6723/secrets) (updated a few minutes after each push). ## Review A dedicated reviewer checked the rule description successfully for: - [ ] logical errors and incorrect information - [ ] information gaps and missing content - [ ] text style and tone - [ ] PR summary and labels follow [the guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule) --------- Co-authored-by: loris-s-sonarsource <loris-s-sonarsource@users.noreply.github.com> Co-authored-by: Loris Sierra <loris.sierra@sonarsource.com>
2023-08-29 15:38:39 +02:00
:example_name: mailgun_key
:example_env: MAILGUN_KEY
include::../../../shared_content/secrets/examples.adoc[]
//=== How does this work?
//=== Pitfalls
//=== Going the extra mile
== Resources
include::../../../shared_content/secrets/resources/standards.adoc[]
//=== Benchmarks
Modify S6723(secrets): Fix docs links
2023-08-31 15:45:11 +02:00
Reference in New Issue Copy Permalink