Secrets (API keys, private keys, etc) are exposed in the code repository or source code. Unnecessary exposure of sensitive data increase likelihood of the system compromise.

Remediation

• Immediately reset the disclosed secrets
• Remove any instances of hardcoded secrets from the code
• Refactor the app to use environment variables or secret files (mounted to the container at run time).
• As the secret has been exposed for a prolonged time, it may have been misused to create persistence (e.g. creating another malicious keys). Create a IoC and monitor for usage of all the disclosed secrets. Monitor for suspicious authenticated activities especially privilege actions
• Remove secrets from the git history using a tool like git filter-repo or BFG Repo-Cleaner