Sensitive Data: TOTP Secret Exposure¶

Identifier: totp_secret_exposure

Scanner(s) Support¶

Description¶

TOTP secret exposure occurs when time-based one-time password seeds are disclosed in responses, client code, logs, configuration, or other accessible data.

How we test: We inspect discovered application data for TOTP seed material and related authenticator provisioning secrets that would allow an attacker to generate valid one-time passwords.

References:

• https://cwe.mitre.org/data/definitions/522.html
• https://datatracker.ietf.org/doc/html/rfc6238

Configuration¶

Example¶

Example configuration:

---
security_tests:
  totp_secret_exposure:
    skip: false

Reference¶

skip¶

Type : boolean

Skip the test if true.