MediumSecrets & credentialsBLWK-CRED-004

A credential file can be read by other users

What this means

‹path› holds a login token for a tool (‹kind›), and other users or programs on this computer can read it (permissions ‹mode›). Token files should be readable by you alone.

How to fix it

Make the file private, then keep the token somewhere safer if the tool allows it.

1. Run chmod 600 ‹path› so only you can read it.
2. Move the token into a password manager and pass it to the tool when it runs: for example op run (1Password) or bws run (Bitwarden).
3. For npm, write //registry.npmjs.org/:_authToken=${NPM_TOKEN} in .npmrc so the file holds no secret.
4. For PyPI, let twine read the token from your keychain: pip install keyring.

If other people use this computer, rotate the token too.

Check it yourself

Run a scan and look for BLWK-CRED-004 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads credential_stores and reports this check when:

kind != "git_config" and readable_by_others == true

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• CIS Benchmark 6.1
• MITRE ATT&CK T1552.001

Related checks

• A long-lived AWS access key is stored on disk · BLWK-CRED-001
• Git stores passwords and tokens in plain text · BLWK-CRED-002
• Docker registry logins are stored in the config file · BLWK-CRED-003
• SSH private key is not passphrase-protected · BLWK-SSH-012
• SSH private key passphrase status could not be determined · BLWK-SSH-013
• A secret is exposed in AI assistant context · BLWK-AI-001