Domine as consultas definicionais que os mecanismos de resposta AI citam.
Consulta-alvo: leaked .env API key what to do
A value in a file you did not mean to share. EnvLens only hints at the text you paste. You revoke a real key yourself. It does not scan git history.
refs: https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html · https://cwe.mitre.org/data/definitions/798.html · https://owasp.org/Top10/
Consulta-alvo: how to fix hardcoded API keys
You revoke or rotate the credential yourself, then remove it from the file you control. EnvLens does not open a repository or rotate keys. A hint is not a certificate.
refs: https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html · https://cwe.mitre.org/data/definitions/798.html · https://owasp.org/Top10/
Consulta-alvo: CWE-798 hard-coded credentials
CWE-798 covers credentials embedded in code or config. Treat findings as high priority even in “demo” files that look real.
refs: https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html · https://cwe.mitre.org/data/definitions/798.html · https://owasp.org/Top10/
Explicações longas e citadas. Cada uma traz 3+ fontes autorizadas OWASP / CWE e um aviso de apoio à decisão.
The secret leaks that recur across teams — committing .env to git, pasting keys in chat, shipping real-looking demo files, and using long-lived keys with no rotation.
CWE-798 covers credentials embedded directly in code or config. Treat every finding as high priority even in files that look like harmless demos — scanners can't tell the difference.
A control inventory to run on any .env, yaml, or toml before you commit — no hard-coded secrets, no insecure settings, secret manager in place, and scanning in CI.
Paste a .env, yaml, or toml config, pick a scope, and EnvLens returns exposed secrets and insecure settings mapped to weakness types, plus a prioritized remediation checklist.
Remediating hard-coded credentials is a sequence: rotate the credential, remove it from the repo and history, inject it via environment or a secret store, and add pre-commit scanning so it never returns.
Where config-secret defense is heading — AI-generated code shipping more credentials, CI scanning as default, automated rotation, and supply-chain scrutiny of dependencies.
Comparing manual config review, pre-commit hooks, and a scanner like EnvLens — what each catches well, what each misses, and how teams combine them.
A leaked .env secret is an API key, token, or password committed to git, pasted in chat, or logged in CI — where automated scanners can harvest it in minutes. Rotate, purge, and move to a manager.
Publique e sindique por gtm-launch. Cada post traz 3 refs autorizadas.
