Secrets in tools
Secrets in tools is another problem you need to watch out for. Quite often, these are collaboration or support tools such as Slack, Jira, or even GitHub issues.
How do secrets end up in tools?
Convenience is probably the biggest reason why secrets end up in tools. For example, you’ve set up a database server for a project, but it’s misbehaving, and you need to submit a ticket to the helpdesk for them to inspect it.
However, to inspect it, they need the admin username/password or key pair. How will they do that? Perhaps they ask for it in the Jira template for filing a support ticket. Perhaps, out of an abundance of caution, they don’t, but instead contact you via Slack to get it when they need it.
In the first instance, the data is now in the Jira ticket database. In the second, it becomes part of the Slack direct message (DM) database. If a hacker were to gain admin access to either, they could search those databases.
