MediumSecrets & credentialsBLWK-AI-015

An AI credential file is readable by other users

What this means

A plaintext credential file readable by group/other.

How to fix it

Make the file private so only you can read it.

1. Run chmod 600 on this file.
2. If the tool supports it, let it keep the token in your computer's keychain instead (macOS Keychain, GNOME Keyring or KWallet, Windows Credential Manager).

Check it yourself

Run a scan and look for BLWK-AI-015 in the results:

bulwark scan
bulwark ai scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

References

• MITRE ATT&CK T1552.001

Related checks

• A long-lived AWS access key is stored on disk · BLWK-CRED-001
• Git stores passwords and tokens in plain text · BLWK-CRED-002
• Docker registry logins are stored in the config file · BLWK-CRED-003
• A credential file can be read by other users · BLWK-CRED-004
• SSH private key is not passphrase-protected · BLWK-SSH-012
• SSH private key passphrase status could not be determined · BLWK-SSH-013