Never transmit secrets to the client
Anything sent to the client can be read or modified by the user. Keep all secrets on the server side only.
OWASP Cheat Sheets · all subjects
secrets
9 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.
Secrets management: never hardcode secrets
Secrets such as API keys or passwords must never be hardcoded in code repositories or CI/CD configuration files.
Secrets management: detect committed secrets
Employ tools such as git-leaks or git-secrets to detect secrets that may have been committed to repositories. Perform ongoing monitoring to detect any deviations.
Secrets management: remove secrets from artifacts
Secrets must be removed from other artifacts such as Docker images and compiled binaries to prevent exposure.
Secrets management: encrypt secrets at rest
Secrets must always be encrypted using industry accepted standards while at rest in a file-system, vault, or similar store.
Secrets management: prevent secrets disclosure during use
Ensure secrets are not disclosed or persisted in cleartext as a consequence of use in the CI/CD pipeline. Secrets must not be printed out to the console, logged, or stored in system command history files such as ~/.bash-history.
Secrets management: use temporary credentials or OTPs
Use temporary credentials or one-time passwords (OTPs) to reduce impact in the event that secrets are stolen by limiting their validity period.
Secrets management: third-party solutions
Third-party solutions such as HashiCorp Vault, AWS Secrets Manager, AKeyless, or CyberArk may be used for secure secrets management in CI/CD environments.
Insecure storage - use Chrome Storage API with encryption
Store sensitive data like authentication tokens in Chrome Storage API rather than localStorage, which provides better security. Encrypt stored data before saving it locally. Never hardcode API keys or credentials within the extension code.