Self-Discovering API Key Permissions and Resources
summary
A concrete method called self-discovery enumerates ownership, permissions and resources for exposed API keys by sending safe, non‑destructive API probes, using string analysis, HTTP request brute‑forcing and malformed requests to infer capabilities. A demoed open source tool, trufflehog analyze, automates those checks for ~20 initial key types and surfaces surprises like the research on 10,000 leaked keys where 74% still valid after 30 days. Examples include GitHub, Stripe and Postgres and the tool reliably maps scopes and accessible resources without requiring provider UI access.
AI-written summary · about
chapters (16)
- 0:00API key exposure challenges
- 2:51Exposed API keys study
- 6:23Key exposure remediation
- 8:51Self-discovery for key ownership
- 11:17API key permission complexities
- 14:25Enumerating key permissions
- 16:53Brute-forcing unsupported APIs
- 19:41Accessible resources via keys
- 22:31TruffleHog Analyze tool
- 24:18GitHub CodeSpaces permissions
- 26:03PostgreSQL connection risks
- 27:52Dynamic key risks
- 30:20Supported key types
- 31:26Logging API calls
- 32:50Bug bounty impact
- 34:35Q&A
related talks
31mFighting Secrets In Source Code With TruffleHog
35mFollow the data to learn the secret
19mProtect Your Digital Assets: Spot and Secure Open APIs Quickly
23mSecurity Considerations in API Docs
59mFlying blind? - The case for API Security and Observability
52mGetting API security right
35mGit those secrets out your repos!
50mA Tour of API Underprotection