Sensitive Data: GitHub Personal Access Token Leak in JavaScript Bundle¶

Identifier: js_data_leak_github_pat

Scanner(s) Support¶

Description¶

GitHub personal access tokens shipped in JavaScript bundles allow attackers to act on behalf of the token owner across repositories and GitHub APIs. GitHub treats access tokens like passwords and recommends keeping them out of client-side code.

How we test: We statically analyze first-party JavaScript bundles for patterns matching GitHub personal access tokens (classic ghp_ prefix).

References:

• CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
• CWE-798: Use of Hard-coded Credentials
• GitHub Docs: Managing your personal access tokens

Configuration¶

Example¶

Example configuration:

---
security_tests:
  js_data_leak_github_pat:
    issues_count_limit: 20
    skip: false

Reference¶

issues_count_limit¶

Type : integer

The maximum number of issues to report. Use 0 to report all issues.

skip¶

Type : boolean

Skip the test if true.