OpenSec Atlas

awesome-list-of-secrets-in-environment-variables: An Open Source Documentation for Secrets Management | OpenSec Atlas

Secrets Management

Documentation

awesome-list-of-secrets-in-environment-variables

A curated and comprehensive list of common secrets and sensitive environment variables to help developers identify and secure secrets stored in environment variables.

View on GitHub

About This Tool

🦄🔒 Awesome list of secrets in environment variables 🖥️

Primary Use Case

This repository is used by developers, security engineers, and DevOps professionals to understand which environment variables commonly hold secrets such as API keys, tokens, and passwords. It serves as a reference to audit, detect, and improve secrets management practices by avoiding direct storage of sensitive information in environment variables or mitigating their exposure.

Key Features

Extensive categorized list of environment variables known to store secrets across multiple platforms and services
Includes examples from AWS, Azure, Binance, Cloud Foundry, and many other providers
Highlights security risks associated with storing secrets in environment variables, including known exploits like CVE-2021-44228
Provides best practice recommendations to mitigate secret leaks, such as encrypting values or storing paths instead of raw secrets
Offers commands to check environment variables on different operating systems
Links to official documentation sources for each secret variable listed
Encourages proactive security measures like WAF blocking and monitoring for environment variable leaks

Insights & Recommendations

Storing secrets directly in environment variables can expose them to attackers through exploits such as the Log4j JNDI vulnerability (CVE-2021-44228). It is recommended to use environment variables to store encrypted values or paths to configuration files instead of raw secrets. Monitoring and blocking suspicious requests containing environment variable data via WAFs can help prevent leaks.

Usage

dir env:

Command to list all environment variables on Windows PowerShell.

printenv

Command to print all environment variables on Linux/MacOS terminals.

env

Alternative command to print all environment variables on Linux/MacOS terminals.

Smart Usage Notes

Integrate this list into CI/CD pipelines to automatically flag insecure environment variables during build and deployment.Use as a baseline for blue teams to create detection rules in SIEMs for environment variable leaks or suspicious access.Red teams can leverage the list to identify potential secrets exposure points during penetration tests or red team exercises.Purple teams can develop joint playbooks to remediate discovered environment variable secret leaks efficiently.Encourage developers to adopt best practices such as referencing encrypted secret stores instead of raw environment variables.