Exposed Secrets
Critical · Configuration
OWASP Top 10:2025 (current)
Not directly mapped to a Top 10:2025 category — see CWE / CVE below.
CWE
CWE-798
CVE / class examples
- Search NVD/CVE for product-specific instances of this CWE
All refs
CWE-798
Definition
API keys/passwords in repos, images, or logs.
Root cause
Secrets in git history or env vars in client.
Affected components
- Components in the “Configuration” class
- Application / API handlers
- Supporting libraries
Impact
Full account compromise.
Severity
Critical · CVSS 9.1
Safe lab reproduction
DevSecOps pipeline labs
Detection methodology
Secret scanning (Gitleaks/TruffleHog).
Evidence examples
- Lab reproduction notes: DevSecOps pipeline labs
- Request/response excerpts (redacted)
- Detection signal: Secret scanning (Gitleaks/TruffleHog)
Remediation
Vault/secret manager; pre-commit hooks.
Secure coding examples
Rotate on exposure; never commit secrets.
Related CYNARKS lessons & labs
Tools: gitleaks · trufflehog
Practise related skills in Labs or deepen on Academy library.