Skip to content

fix: remove leaked Alibaba Cloud AccessKey secret data#14421

Open
karabo17-x wants to merge 2 commits into
Azure:masterfrom
karabo17-x:fix/secret-scanning-alert-63
Open

fix: remove leaked Alibaba Cloud AccessKey secret data#14421
karabo17-x wants to merge 2 commits into
Azure:masterfrom
karabo17-x:fix/secret-scanning-alert-63

Conversation

@karabo17-x
Copy link
Copy Markdown

@karabo17-x karabo17-x commented Jun 5, 2026

Security Fix GitHub Secret Scanning Alert #63

Summary

This PR removes a publicly leaked Alibaba Cloud AccessKey Secret that was
hardcoded in sample data, flagged by GitHub Secret Scanning as Alert #63.


What was changed

File: Sample Data/Fortinet FortiNDR Cloud/suricata_http_domain.json

Replaced real credential values in the intel[0] object with clearly
labelled placeholder strings:

Field Before After
aggregator 9bniCI45031Ye01WwhFhoi2vBZhNmY SAMPLE_AGGREGATOR_ID_REPLACE_WITH_ACTUAL
meta GEP1ZeEAIZymjKss5EYQbpBwJ5Gy6H SAMPLE_META_TOKEN_REPLACE_WITH_ACTUAL

Action Required from Codeowners

Since this is a public repository and the secret has already been exposed,
the key must be revoked in Alibaba Cloud regardless of this merge.

Steps for the repository owner to action:

  1. **Log in to Alibaba Cloud **
    Navigate to: Identities -- Users -- find the user owning this AccessKey

  2. Disable the key
    Authentication tab -- find key GEP1ZeEAIZymjKss5EYQbpBwJ5Gy6H -- click Disable

  3. Delete the key
    Once disabled -- click Delete -- confirm

  4. Check ActionTrail for unauthorized use
    Filter by this AccessKey ID and look for any unexpected API calls
    (e.g. CreateUser, AttachPolicy, ListBuckets, GetObject)

  5. Rotate if the key was in active use
    Create a new AccessKey and update it in any systems that relied on it

  6. Close GitHub Secret Scanning Alert Add data sources to VM insights dashboard #63
    Security -- Secret scanning -- Alert #63 -- Close as -- Revoked


References

@karabo17-x karabo17-x requested a review from a team as a code owner June 5, 2026 11:07
@karabo17-x karabo17-x closed this Jun 5, 2026
@karabo17-x karabo17-x reopened this Jun 5, 2026
@karabo17-x
Copy link
Copy Markdown
Author

@microsoft-github-policy-service agree

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Sample Data Sample Data

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants