Hardcoded DroneCI access token in source codeSCT-1033

Leaking a DroneCI access token in source code can lead to unauthorized access to the CI/CD pipeline and sensitive information, such as source code, build artifacts, and environment variables. This can result in a security breach and potential financial loss due to unauthorized utilization of CI/CD resources.

If an access token has been leaked, it is recommended to revoke it immediately in the DroneCI dashboard to mitigate the vulnerability.

To avoid hardcoded access tokens in the source code, it is advisable to use environment variables. Storing the access token in an environment variable ensures that it is not visible in the codebase and is kept separate from the source code. Using environment variables also makes it easier to manage access tokens as they can be updated without modifying the source code.

Bad practice

import requests

DRONECI_ACCESS_TOKEN = "0123456789abcdef0123456789abcdef01234567"

response = requests.get(
    'https://droneci.com/api/v1/builds',
    headers={'Authorization': f'Bearer {DRONECI_ACCESS_TOKEN}'}
)

Recommended

import requests
import os

DRONECI_ACCESS_TOKEN = os.getenv('DRONECI_ACCESS_TOKEN')

response = requests.get(
    'https://droneci.com/api/v1/builds',
    headers={'Authorization': f'Bearer {DRONECI_ACCESS_TOKEN}'}
)