Update totally_not_secrets.yaml by sean-jit · Pull Request #2 · jit-se-demo/WebGoat

sean-jit · 2023-09-28T17:57:48Z

Thank you for submitting a pull request to the WebGoat!

jit-ci · 2023-09-28T17:58:14Z

Hi, I’m Jit, a friendly security platform designed to help developers build secure applications from day zero with an MVS (Minimal viable security) mindset.

In case there are security findings, they will be communicated to you as a comment inside the PR.

Hope you’ll enjoy using Jit.

Questions? Comments? Want to learn more? Get in touch with us.

jit-ci

❌ Jit has detected 10 important findings in this PR that you should review.
The findings are detailed below as separate comments.
It’s highly recommended that you fix these security issues before merge.

jit-ci · 2023-09-28T17:59:30Z

totally_not_secrets.yaml

+MAILGUN_API = 'key-LPxoYCANGEFkAMHBur4jTjbZ69ngpdbI'
+
+GITHUB_PAT_ONE = 'ghp_00a00aDDAg111xaAA7nAA0AalMspJB0tNaaa'
+GITHUB_PAT_TWO = 'ghp_99g00bXXGj528xxAA4kQG2CxlMspJB0tNxaz'


Security control: Secret Detection

Type: Github-Pat

Description: GitHub Personal Access Token

Severity: HIGH

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

jit-ci · 2023-09-28T17:59:30Z

totally_not_secrets.yaml

+
+STRIPE = 'pk_live_abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ'
+
+SLACK = 'xapp-1-A01C259PH2A-1440755929120-7d5241948a2cc1b464add85df8a8e75f9040ae2869f6599926ed0b9dcafdb32b'


Security control: Secret Detection

Type: Slack-App-Token

Description: Slack App-level token

Severity: HIGH

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

jit-ci · 2023-09-28T17:59:30Z

totally_not_secrets.yaml

+
+TWILIO_API = 'SK5d1d319A6Acf7EC9BDeDb8CCe4D76BA8'
+
+MAILGUN_API = 'key-LPxoYCANGEFkAMHBur4jTjbZ69ngpdbI'


Security control: Secret Detection

Type: Generic-Api-Key

Description: Generic API Key

Severity: HIGH

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

jit-ci · 2023-09-28T17:59:30Z

totally_not_secrets.yaml

-jwt_secret: YourJWTSecretKeyHere
+GOOGLE_API = 'AIzaSyBUPHAjZl3n8Eza66ka6B78iVyPteC5MgM'
+
+STRIPE = 'pk_live_abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ'


Security control: Secret Detection

Type: Stripe-Access-Token

Description: Stripe Access Token

Severity: HIGH

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

jit-ci · 2023-09-28T17:59:30Z

totally_not_secrets.yaml

+
+MAILGUN_API = 'key-LPxoYCANGEFkAMHBur4jTjbZ69ngpdbI'
+
+GITHUB_PAT_ONE = 'ghp_00a00aDDAg111xaAA7nAA0AalMspJB0tNaaa'


Security control: Secret Detection

Type: Github-Pat

Description: GitHub Personal Access Token

Severity: HIGH

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

jit-ci · 2023-09-28T17:59:30Z

totally_not_secrets.yaml

-mysql_password: MySQLPassword123
-postgres_password: myPostgresPassw0rd
-jwt_secret: YourJWTSecretKeyHere
+GOOGLE_API = 'AIzaSyBUPHAjZl3n8Eza66ka6B78iVyPteC5MgM'


Security control: Secret Detection

Type: Gcp-Api-Key

Description: GCP API key

Severity: HIGH

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

jit-ci · 2023-09-28T17:59:30Z

totally_not_secrets.yaml

+SLACK_BOT = 'xoxb-730191371696-1413868247813-IG7Z6nYevC2hdviE3aJhb5kY'
+
+AWS_KEY_ONE = 'AKIAIWSXFHRM7F6Z3NWQ'
+AWS_KEY_TWO = 'AKIASLEPEFMTEF3JEWSP'


Security control: Secret Detection

Type: Aws-Access-Token

Description: AWS

Severity: HIGH

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

jit-ci · 2023-09-28T17:59:31Z

totally_not_secrets.yaml

+SLACK = 'xapp-1-A01C259PH2A-1440755929120-7d5241948a2cc1b464add85df8a8e75f9040ae2869f6599926ed0b9dcafdb32b'
+SLACK_BOT = 'xoxb-730191371696-1413868247813-IG7Z6nYevC2hdviE3aJhb5kY'
+
+AWS_KEY_ONE = 'AKIAIWSXFHRM7F6Z3NWQ'


Security control: Secret Detection

Type: Aws-Access-Token

Description: AWS

Severity: HIGH

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

jit-ci · 2023-09-28T17:59:31Z

totally_not_secrets.yaml

+STRIPE = 'pk_live_abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ'
+
+SLACK = 'xapp-1-A01C259PH2A-1440755929120-7d5241948a2cc1b464add85df8a8e75f9040ae2869f6599926ed0b9dcafdb32b'
+SLACK_BOT = 'xoxb-730191371696-1413868247813-IG7Z6nYevC2hdviE3aJhb5kY'


Security control: Secret Detection

Type: Slack-Bot-Token

Description: Slack Bot token

Severity: HIGH

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

jit-ci · 2023-09-28T17:59:31Z

totally_not_secrets.yaml

+AWS_KEY_ONE = 'AKIAIWSXFHRM7F6Z3NWQ'
+AWS_KEY_TWO = 'AKIASLEPEFMTEF3JEWSP'
+
+TWILIO_API = 'SK5d1d319A6Acf7EC9BDeDb8CCe4D76BA8'


Security control: Secret Detection

Type: Twilio-Api-Key

Description: Twilio API Key

Severity: HIGH

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

Update totally_not_secrets.yaml

3a1327d

jit-ci bot reviewed Sep 28, 2023

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update totally_not_secrets.yaml#2

Update totally_not_secrets.yaml#2
sean-jit wants to merge 1 commit intomainfrom
sean-jit-patch-2

sean-jit commented Sep 28, 2023

Uh oh!

jit-ci bot commented Sep 28, 2023

Uh oh!

jit-ci bot left a comment

Uh oh!

jit-ci bot Sep 28, 2023

Uh oh!

jit-ci bot Sep 28, 2023

Uh oh!

jit-ci bot Sep 28, 2023

Uh oh!

jit-ci bot Sep 28, 2023

Uh oh!

jit-ci bot Sep 28, 2023

Uh oh!

jit-ci bot Sep 28, 2023

Uh oh!

jit-ci bot Sep 28, 2023

Uh oh!

jit-ci bot Sep 28, 2023

Uh oh!

jit-ci bot Sep 28, 2023

Uh oh!

jit-ci bot Sep 28, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant


		STRIPE = 'pk_live_abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ'

		SLACK = 'xapp-1-A01C259PH2A-1440755929120-7d5241948a2cc1b464add85df8a8e75f9040ae2869f6599926ed0b9dcafdb32b'


		TWILIO_API = 'SK5d1d319A6Acf7EC9BDeDb8CCe4D76BA8'

		MAILGUN_API = 'key-LPxoYCANGEFkAMHBur4jTjbZ69ngpdbI'


		MAILGUN_API = 'key-LPxoYCANGEFkAMHBur4jTjbZ69ngpdbI'

		GITHUB_PAT_ONE = 'ghp_00a00aDDAg111xaAA7nAA0AalMspJB0tNaaa'

Conversation

sean-jit commented Sep 28, 2023

Uh oh!

jit-ci bot commented Sep 28, 2023

Uh oh!

jit-ci bot left a comment

Choose a reason for hiding this comment

Uh oh!

jit-ci bot Sep 28, 2023

Choose a reason for hiding this comment

Uh oh!

jit-ci bot Sep 28, 2023

Choose a reason for hiding this comment

Uh oh!

jit-ci bot Sep 28, 2023

Choose a reason for hiding this comment

Uh oh!

jit-ci bot Sep 28, 2023

Choose a reason for hiding this comment

Uh oh!

jit-ci bot Sep 28, 2023

Choose a reason for hiding this comment

Uh oh!

jit-ci bot Sep 28, 2023

Choose a reason for hiding this comment

Uh oh!

jit-ci bot Sep 28, 2023

Choose a reason for hiding this comment

Uh oh!

jit-ci bot Sep 28, 2023

Choose a reason for hiding this comment

Uh oh!

jit-ci bot Sep 28, 2023

Choose a reason for hiding this comment

Uh oh!

jit-ci bot Sep 28, 2023

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant