Rules / GL088

GL088 Hardcoded token in script line

Severity: error
OWASP: CICD-SEC-6 – Insufficient Credential Hygiene
CWE: CWE-798 – Use of Hard-coded Credentials

Risk

A token written directly into a command, such as sonar-scanner -Dsonar.token=sqp_… or curl -H "PRIVATE-TOKEN: glpat-…", is committed to the repository. Everyone who can read the repository or its history can use it, and it stays in the git history after it is removed from the file.

What glsec checks

Every script line (script:, before_script:, after_script:, default:, hooks:pre_get_sources_script, run: steps) for the token formats that GL006 recognises in variables:: GitLab, GitHub, AWS, Slack, OpenAI, npm, PyPI, SonarQube and the others listed there. In a script line a token has to stand on its own: it may not be preceded or followed by a letter, digit, _ or -. Each token is reported once.

Not checked in script lines: the GCP service account pattern ("type": "service_account"), because a script that inspects a key file's type contains the same text.

Values that reference a variable ($SONAR_TOKEN, ${NPM_TOKEN}) are not tokens. Obvious placeholders are skipped as in GL006: a token containing example, placeholder, changeme, redacted or your-token-here (case-insensitive).

Trigger example

sonar:
  script:
    - sonar-scanner -Dsonar.token=sqp_0123456789abcdef0123456789abcdef01234567

Safe alternative

Store the token as a masked CI/CD variable (Settings → CI/CD → Variables) and reference it:

sonar:
  script:
    - sonar-scanner -Dsonar.token="$SONAR_TOKEN"

A token that was committed has to be rotated: removing it from the file leaves it in the git history.

GL088 Hardcoded token in script line

Risk

What glsec checks

Trigger example

Safe alternative

See also