Tech, ExplainedNetworking, infrastructure and security
Concept

Hard-coded secrets

Passwords hiding in the code.

HOW IT WORKSA program needs apassword or key toreach another systemA developer writesthe key directlyinto the codeThe code is copied toa repository, a buildor an appAnyone who reads acopy can read the keyA scanner, oran attacker,finds the keyA secret in the code travels with every copy of thecode, so programs should fetch it from a vault instead.HOW IT WORKSA programneeds apassword orkey to reachanothersystemA developerwrites thekey directlyinto the codeThe code iscopied to arepository,a buildor an appAnyone whoreads acopy canread the keyA scanner, oran attacker,finds the keyA secret in the code travels with every copy of thecode, so programs should fetch it from a vault instead.HOW IT WORKSA program needs a password or key toreach another system↓A developer writes the key directly intothe code↓The code is copied to a repository, abuild or an app↓Anyone who reads a copy can read the key↓A scanner, or an attacker, finds the keyA secret in the code travels with every copy of the code,so programs should fetch it from a vault instead.
A password written into the code travels with every copy of that code, until someone reads it and uses it; a vault keeps it out of the code instead.
opens a page inside this one a page in the same scene a page in another scene a concept page a label only, with no page

Hard-coded secrets are passwords, keys and tokens written directly into a program's code or settings files, instead of being kept in a protected store. A secret, in software, is anything a program uses to prove who it is to another system. Examples are a database password, a cloud access key, and an API key, the long string of characters that a service gives a customer's program so that it can recognise that program.

Here is how a secret ends up in the code. A developer needs the program to reach a database, and types the password into the code to get it working. The code is then saved to a repository, the shared store of the team's code. The repository keeps every old version, so deleting the line later does not remove the password from the history. The code is then copied many times: to other developers, to contractors, into builds and sometimes into a public repository. If the program is a phone app, the secret is packed inside the app file on every customer's phone. Anyone who reads any of these copies can read the secret. Attackers run automated searches of public code sites, and they can find a new key within minutes.

The fix is to keep secrets out of the code. Secrets management keeps them in a vault. The program asks the vault for the secret when it starts, using its own identity, and the vault changes the secret regularly. Secret scanners, often part of static application security testing tools, check each change to the code and block one that contains a secret.

Take, for example, a developer who leaves a cloud access key in a script and pushes it to a public repository. Within hours, someone can use the key to start servers on the company's account, and the bill arrives at the end of the month.

Consider a shopping app for phones with a payment provider's key inside it. Anyone can unpack the app and read the key, which is why mobile app shielding and outside-in scans by external attack surface management look for exactly this.

Say a company sells home routers that all ship with the same administrator password written into the firmware. One leaked password then opens every router of that model.

How is a hard-coded secret different from a stolen employee password? An employee's login usually asks for a second check, such as an OTP. A program's secret usually has no second check, often has wide permissions and is rarely changed. So one leaked key can open a whole database. Programs that log in this way are non-human identities.

Appears in

Networking, infrastructure and security
Tech, Explained is a part of ingrid.fyi. Every page explains one piece of technology in plain words.