akto
akto copied to clipboard
akto-api-security
⚡️ Add sensitive data secrets types for products
💭 Introduction
Akto allows users to find sensitive params in request and response of APIs. These sensitive params include PII data such as SSN, Credit card number, phone number etc. You can check how it works in the docs.
Your task is to add secret types sensitive params.
👀 Impact
Your task will give users the ability to detect secret types sensitive data types.
🎯 Requirements
- Understanding of regex
- Understanding of unit test
✅ Task summary:
- [ ] Ask to be assigned to the issue.
- [ ] Wait to be assigned. We will try to assign in less than 2 hours.
- [ ] Make regular expressions for secret types for below products. Feel free to add your own too.
- [ ] Please provide the reference URL that mentions the nature of the number.
- [ ] Add an entry in fintech.json file
- [ ] Add a test case entry in TestFintechTypes.java
- [ ] Submit a pull request here
Github,
AWS,
GCP,
Docker
🙋🏼♂️ Questions:
If you have questions, need any help, or just want to hang out, make sure to join us on our Discord server.
Hi @PrateekKrishna thanks for your submission in Hackfest. 🔥 We are reviewing your work. Do these two below:
Join this group on discord for discussions around prizes? 🚀 🏆 Please fill this form your PR to be considered for prizes!
@Ankita28g @ankush-jain-akto could you please assign this to me. I can work on this.
Question regarding the issue. You mention that the regex for secrets for the "below" products must be created. Then there's list containing (GitHub, AWS, GCP, Docker). My question is what type of secret are you referring to. In case of say PAN the secret structure is defined. But I do not get for what entities do we need to create the secret regex for. And also I would like to be assigned to this issue.
@Ankita28g Can you assign me this issue? Also when we talk about secrets, is it something like access key secret that we use for AWS logins?
@atharvamalji For example, when we consider Github, it has various secrets like access tokens, API keys, and more, each with a specific pattern. Your task is to add these secret patterns to the fintech.json file. This applies similarly to other products like AWS, GCP, and Docker, where each has its own set of secrets with identifiable patterns.
I've assigned it to you, @syedzubeen. Happy hacking! Feel free to join our Discord if you need assistance.