Skip to main content

Pro audit program · v1.0

API Token & Secrets Audit

Leaked API tokens are a top breach vector. Check inventory, scoping, storage and rotation of personal access tokens and machine secrets.

  • General target area
  • CIS Controls framework
  • 6 controls in this program
  • Cyentrix Cyentrix Trusted Author
Sign in to run → Back to library

About this program

Leaked API tokens are a top breach vector. Check inventory, scoping, storage and rotation of personal access tokens and machine secrets.

Risks addressed

  • Critical Leaked token in public repo grants attacker prod access
  • High Long-lived tokens never expire
  • High Tokens stored in plain text in CI/CD

Controls (6)

  1. Inventory of API tokens / PATs

    High

    This control requires maintaining a complete, centralized inventory of all API tokens, personal access tokens (PATs), and service account credentials used across systems, applications, and cloud environments. The inventory should document token purpose, scope, ownership, creation date, expiration status, and…

    How to test + evidence

    Testing procedure: Pull token list from each platform (GitHub, Slack, AWS, etc.). Reconcile with owners.

    Evidence to collect: Token inventory CSV.

  2. Tokens scoped to least privilege

    High

    Tokens scoped to least privilege ensures that API tokens, service account credentials, OAuth tokens, and personal access tokens (PATs) are granted only the minimum permissions required to perform their intended function. This control involves defining granular scopes or roles for…

    How to test + evidence

    Testing procedure: Sample tokens; verify scopes match the actual use.

    Evidence to collect: Token scope dump.

  3. Secret scanning in repos + CI

    Critical

    Secret scanning is an automated control that detects hard-coded credentials, API keys, tokens, certificates, and other sensitive authentication material committed to source code repositories or introduced during continuous integration pipelines. Scanning tools use pattern matching, entropy analysis, and signature-based detection…

    How to test + evidence

    Testing procedure: Repo + commit scanning enabled; pre-commit + push hooks in place.

    Evidence to collect: Scanner config + last 30-day alerts.

  4. Secrets stored in a managed vault

    Critical

    This control requires that cryptographic secrets (API keys, database passwords, private keys, tokens, service account credentials) be stored exclusively in a dedicated secrets management vault such as HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, or CyberArk. Secrets are not…

    How to test + evidence

    Testing procedure: No plaintext secrets in code, CI variables, or config files.

    Evidence to collect: Vault coverage report.

  5. Token expiry / rotation policy

    High

    Token expiry and rotation policies enforce automatic invalidation of authentication tokens (API keys, OAuth tokens, session tokens, service account credentials) after a defined time period or usage threshold. This control mandates maximum lifetimes for tokens, forces periodic regeneration, and ensures…

    How to test + evidence

    Testing procedure: Max token lifetime documented and enforced (90d for human, shorter for machine).

    Evidence to collect: Token policy + rotation log.

  6. Revoke tokens on offboarding

    High

    This control ensures that all authentication tokens (API keys, OAuth tokens, session tokens, personal access tokens, service account credentials) issued to an employee or contractor are systematically revoked or invalidated upon termination or role change. It requires integration between HR…

    How to test + evidence

    Testing procedure: Joiner-mover-leaver process explicitly revokes all PATs.

    Evidence to collect: JML checklist.