Security finding
A key or password is readable in the page source
Security Error Severity: High
Part of the audit Information exposure. Finding id: security.secretsInSource.
What it costs you
Anyone who views the page source has the key and can use the service it opens in your name and at your cost.
What to do
Revoke the key at the service that issued it and create a new one. Removing it from the page is not enough, because copies of the page exist.
What it checks
- Secrets left in page code or comments
How to fix it
Revoke, replace, then remove
- Revoke or rotate the key at its provider first.
- Keep the new key on the server: in an environment variable or a secrets store, never in a template, a comment or a script sent to the browser.
- If the browser must call the service, route the call through your own server, or use a key the provider lets you restrict to your domain.
- Check the provider's usage log for calls you do not recognise.
How to check: View the source of [page url] and search for the first characters of the old key: not found. The old key no longer works at the provider.
A real case
Source code of Toyota's T-Connect site, published on GitHub by a contractor, contained a key to a customer data server for almost five years. Toyota said in October 2022 that the email addresses and customer numbers of 296,019 users could have been accessed.