HighSecrets & credentialsBLWK-AI-016

A secret-bearing AI file is not covered by .gitignore

What this means

A secret-bearing file in a git repo with no .gitignore rule covering it.

How to fix it

Add this file to .gitignore (and, if it was already committed, git rm --cached it and rotate the credential). Sitting in a git repo without an ignore rule, a secret is one git add . away from being pushed — and stays in history forever.

Check it yourself

Run a scan and look for BLWK-AI-016 in the results:

bulwark scan
bulwark ai scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

References

• MITRE ATT&CK T1552.001

Related checks

• A long-lived AWS access key is stored on disk · BLWK-CRED-001
• Git stores passwords and tokens in plain text · BLWK-CRED-002
• Docker registry logins are stored in the config file · BLWK-CRED-003
• A credential file can be read by other users · BLWK-CRED-004
• SSH private key is not passphrase-protected · BLWK-SSH-012
• SSH private key passphrase status could not be determined · BLWK-SSH-013