Loading…
21
Spent 3 days chasing a secrets leak in our CI pipeline, turned out to be a .env file from 2019
Last month our scanner kept flagging a live API key in the build logs every single run, so I rotated the key, purged the cache, and even rebuilt the runner from scratch, but it kept showing up. Turned out an old .env file was baked into a Docker layer from a commit back in 2019, and the scanner was reading the layer history the whole time. How do you all handle secret scanning on old images without nuking your registry?
1 comments
Log in to join the discussion
Log In1 Comment
wadeyoung8d ago
Had a similar thing with Jenkins in 2021, old creds hiding in a base image nobody touched since the Obama years.
8