The service always stores sensitive values such as API keys, passwords, and certificates as named secrets that can be retrieved only by authorized users and external systems.
Secret Storage
CCC.SecMgmt.CP01
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.SecMgmt.TH01 | Secret Values are Exposed Outside the Service | A secret value retrieved through the API or command-line interface may be written to terminal output, shell history, build logs, environment variables, or application logs, or may be readable by any identity holding a broad read permission on the secret. Plaintext copies of the value then exist outside the service's access control and audit trail. The confidentiality of the credential is lost, and the credential could be used to access the systems it protects. |