Hardcoded PlanetScale credentials in source codeSCT-1020

Leaking PlanetScale credentials in the source code can cause severe security issues as it can give unauthorized access to PlanetScale resources, which can result in a data breach and financial loss. PlanetScale credentials can include API tokens, OAuth tokens, and passwords, and all of them must be kept secret.

If PlanetScale credentials have been leaked, you can revoke the tokens and change the passwords to mitigate the vulnerability.

To avoid this issue, the recommended practice is to store the credentials in a secure and centralized location, such as a secrets manager. This ensures that the credentials are not hardcoded in the source code and are kept separate from the codebase. Using a secrets manager also makes it easier to manage the credentials as they can be updated without modifying the source code. Additionally, it is recommended that access to the credentials is restricted to only those who need it, by using IAM roles and permissions.

Bad practice

import planetscale

client = planetscale.Client('live_1234', 'api_key_1234')

Recommended

import planetscale
import os

PLANETSCALE_API_KEY = os.getenv('PLANETSCALE_API_KEY')
PLANETSCALE_OAUTH_TOKEN = os.getenv('PLANETSCALE_OAUTH_TOKEN')
PLANETSCALE_PASSWORD = os.getenv('PLANETSCALE_PASSWORD')

client = planetscale.Client('live_1234', api_key=PLANETSCALE_API_KEY, oauth_token=PLANETSCALE_OAUTH_TOKEN, password=PLANETSCALE_PASSWORD)

References

• PlanetScale API and OAuth applications