HighSecrets & credentialsBLWK-CRED-002

Git stores passwords and tokens in plain text

What this means

Git is saving your passwords and access tokens in a plain text file (‹path›). Any program running as you can read it, and a GitHub token usually lets someone push code to your repositories or publish packages in your name.

How to fix it

Let Git keep your tokens in your computer's keychain instead of a plain file.

1. For GitHub, run gh auth setup-git. Git then uses the GitHub CLI's login, which is stored in your keychain.
2. For other Git hosts, install Git Credential Manager. It works on Linux, macOS and Windows and uses the system keychain.
3. Stop using the plain-file store: git config --global --unset credential.helper.
4. Delete ~/.git-credentials and revoke the tokens it contained, in case they were already copied.

Even better: use SSH keys for Git, protected by a passphrase or a hardware key.

Check it yourself

Run a scan and look for BLWK-CRED-002 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads credential_stores and reports this check when:

(kind == "git_credentials" and stored_entries > 0) or (kind == "git_config" and helper_store == true)

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• MITRE ATT&CK T1552.001

Related checks

• A long-lived AWS access key is stored on disk · BLWK-CRED-001
• Docker registry logins are stored in the config file · BLWK-CRED-003
• A credential file can be read by other users · BLWK-CRED-004
• SSH private key is not passphrase-protected · BLWK-SSH-012
• SSH private key passphrase status could not be determined · BLWK-SSH-013
• A secret is exposed in AI assistant context · BLWK-AI-001