Production secret key leak in config/secrets.yml

Disclosed: 2019-01-08 07:55:23 By phreak To grab
High
Vulnerability Details
**Summary:** Production secret key leak in config/secrets.yml **Description:** In Github, http://engineering.grab.com/ secret_key_base is leaked which is present in the config/secrets.yml ## Steps To Reproduce: 1. Go to the below GitHub URL and we can verify that secret_key_base is present. ``` https://github.com/grab/blogs/blob/master/2017-01-29-deep-dive-into-database-timeouts-in-rails/config/secrets.yml ``` Mitigation:- ``` https://medium.com/@thejasonfile/hide-your-api-keys-hide-your-skype-api-keys-884427746f9c ``` ## Impact Proper Impact is explained here:- https://stackoverflow.com/questions/44220691/rails-what-are-the-consequences-of-a-leaked-secret-key-base
Actions
View on HackerOne
Report Stats
  • Report ID: 456997
  • State: Closed
  • Substate: informative
  • Upvotes: 8
Share this report