DOS5935: Codespaces Secret - Name should not look like a generic password | Security KB - DevOps Shield - The ultimate DevSecOps platform designed to secure your DevOps.

This website stores cookies on your computer.These cookies are used to collect information about how you interact with our website and allow us to remember you. We use this information to improve and customize your browsing experience and for analytics and metrics about our visitors both on this website and other media. To find out more about the cookies we use, please review our Privacy Policy.

If you decline, your information won’t be tracked when you visit this website. A single cookie will be used in your browser to remember your preference not to be tracked.
By clicking “Accept All”, you agree to the storing of cookies on your device to enhance site navigation, analyze site usage, and assist in our marketing efforts.

GitHub repository Severitymedium builtIn

Description

A Codespaces secret literally named 'PASSWORD' (or PASSWORD_1, PASSWORD_PROD, etc.) is a maintenance hazard: rotating it requires updating every dependent devcontainer because the name conveys nothing about its purpose. Use brand-specific names (NPM_REGISTRY_TOKEN, AZURE_AD_CLIENT_SECRET, GITHUB_PAT_FOR_PRIVATE_PKGS). Generic password names are also a red flag for credential reuse across services.

Learn More

https://docs.github.com/en/codespaces/managing-codespaces-for-your-organization/managing-development-environment-secrets-for-your-repository-or-organization

Recommendation

1. Go to Repository or Organization Settings -> Secrets and variables -> Codespaces. 
2. Rename PASSWORD / PASSWORD_* secrets to reflect their specific purpose. 
3. Update devcontainer.json env mappings.

Policy Rule

{
  "target": "GHCodespacesSecret",
  "if": {
    "allOf": [
      {
        "resource": "GHCodespacesSecret",
        "property": "Name",
        "operator": "notMatch",
        "value": "^PASSWORD(_.*)?$"
      }
    ]
  },
  "then": {
    "effect": "Audit"
  }
}

« DOS5930 DOS6010 »

Rule Details

Rule ID: DOS5935
Code: GH_Repository_Codespaces_Secret_Name_Should_Not_Be_Generic_Password
Platform: GitHub
Category: repository
Severity: Severitymedium
Type: builtIn

DOS5935

Codespaces Secret - Name should not look like a generic password

DOS5935

Description

Recommendation

Policy Rule

View evaluation logic (JSON)

Rule Details

Related Rules