Credential Exposure Through Environment Variables
#TRUSTED 1aa635376dc0d910117175c690d4cfda0fdf1b32790fa3deff2282a4384e09628e9a931b8dbf796b8a194b3a6c0b19ea5edf496a652b10f8bbae5a96197425adb47d268f991a798efb559580cf82ee97a6817d3d72f1ce83e2a77f2a2dc5c67236d4934c2705bff8c8f689a7d024947cf550563fb301964a9ea53a298fb96fcd702d5161fce31687788f5d0474a6b078dfaee39f6e91f943e07c27cea35face2fbde8b33f2492ff6c6f53bcc8a63880dc3116598f9aa9b5ce6a1f126154bc9241a7c304f5f83f25bcd61ab60c0bced306f214debc835524057418e5228e3c24512c1ebc1af36b2b5d81e4aeb584ce563ce792e89959f3917b40517cb49a7c689e7310c98f17df1961dd1844f138ad70e3e86b81ffa471ad86551a316727dc07857ba58683300be9d3a5094405469f139ad4910f04401e2b36a5f6fa78903ff69a17d08e25396634663adab39f583f1ddb333401c70db352c40439b30481acdbe3e622b7a14debd952d8ab2f4757c9e5b8e586cb6b8b3dbad57308e57d42cf33f813e04fbd63f8b78799f38c9dd03b33b77e2811db8ace772b86c414ffba45ccb47540c4b8b426f07a96d382201ee2903cf4158c45f6f75125789ccc7d565f8dee719f7559048a4b1fa82f7935774b6cfdf5bedd0572295b0c48c18742a2ae67d0723294fbfdba4f28379af87c61f1a1bb88bec435403839a300fd49fa36db7ca
#TRUST-RSA-SHA256 6107807ebce4bd7ef8c5a568d570c644e31a9ffedb9d5fb9f6f0c3a31358f5b6e547362e4bd2cff323109a9d2043eacad956e1f4c231d408f7da39307b6961b0893a134eff3dd2c46f487e9c654fa199c2b9695ed2a9e126dea9de848f6c481db2a54f94a65bb60c68f32db4c32bd1ec9ec98a0c9a28108fa21a452c39d9714a204b166c1299211781f280d5bd718c99f9b5402515727dc4ace3fb26b636327971fb22bd31950bd61f9946fce0af0ffa0802e647a0932139357bd9f50f5d124203e66b60a3f46607619efe6c76378ef5a252df50a654ac32f088034d1445e4a7e29b48a5ff262aab6e5009efa00b1eff3d7d91c97950848866df5ac05cd7ffdaf14d525fc8066ce5fcf3e02c66dfa5637b36ab462408079649bda10cc89e4b84372b16620e09466adb4e6c19c09ee64ab3dc3ab8f68e67c9f2b7bca9ddd778baa691595bbfc904fe925a3d9d13ec04dd9200bbe3db9b39d1baf8e51b98df8affc0e4dd69c985fdd543f80c90e931d748246309ca981845dae8ff2a2b59ced2062be97b1783ca312d9484fc3cbe08af0f702be0d8fd4f2560100162ea5d0d4f1f5bcdad90d024f8edc81426320fc5dd050bc0dc850c32f6c78a5f8d93f62dc49386343ca42e85c5bedf7598fbc506f18adfc5152dfc2df54826d65b6c9e8645e985c134a706d292b0f6bcb1d626eba9202ee6dd5898dfab75df9fef2082471bf6
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##
include('compat.inc');
if(description)
{
script_id(345665);
script_version("1.1");
script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/14");
script_name(english:"Credential Exposure Through Environment Variables");
script_set_attribute(attribute:"synopsis", value:
"Discovers environment variables that may expose secrets to attackers");
script_set_attribute(attribute:"description", value:
"This plugin identifies credentials or secrets that are potentially
exposed to malicious actors by environment variables on the target
host.
Attackers who establish a foothold on a target can escalate or move
laterally using passwords, access tokens or API keys stored in local
environment variables. Even identities such as user names or
service accounts can become valuable clues to aid exploitation.
This plugin identifies potential exposure of this sensitive data
based on the names of environment variables that appear in product
documentation or examples which are often used to ease access to
cloud services, enterprise APIs or remote hosts.");
script_set_attribute(attribute:"solution", value:
"Verify the finding, this finding is based primarily on environment
variable names which could produce false positives. Modify access
procedures to use a credential manager or to manually provision
credentials from a secure location.");
script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:M/C:C/I:C/A:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H");
script_set_attribute(attribute:"cvss_score_source", value:"manual");
script_set_attribute(attribute:"cvss3_score_source", value:"manual");
script_set_attribute(attribute:"cvss_score_rationale", value:"Tenable score based on exploit profile.");
script_set_attribute(attribute:"cvss3_score_rationale", value:"Tenable score based on exploit profile.");
script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/14");
script_set_attribute(attribute:"agent", value:"all");
script_set_attribute(attribute:"plugin_type", value:"local");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"General");
script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("microsoft_windows_env_vars.nasl", "enumerate_nix_env_vars.nasl");
script_require_keys("Host/env_vars/enumerated");
exit(0);
}
include("debug.inc");
include("structured_data_environment_variable.inc");
get_kb_item_or_exit("Host/env_vars/enumerated");
var cred_regexes = {
"BASE64": "^[a-zA-Z0-9/+=]+$",
"AWS1": "^[A-Z]{4}[A-Z2-7]+$",
"AWS2": "^[^\s\[\]/]+$",
"UUID": "^[A-Fa-f0-9-]+$",
"ALL": "^\S+$",
"AZURE1": "^[a-zA-Z0-9_-.][a-zA-Z0-9_-]+$",
"OAUTH": "^[-a-zA-Z0-9._~+/]+=*$",
"NOSPACE": "^[^ \t]+$",
"ALIACC": "^(?:LTAI|STS\.)[0-9a-zA-Z]{20}$",
"ALPHANUM": "^[a-zA-Z0-9]+$",
"ALISTS": "^CAIS[0-9a-zA-Z]+$",
"GH_TOKEN1": "^(?:gh[pousr]|github_pat_)[a-zA-Z0-9]+$",
"GH_TOKEN2": "^gl[a-z]+-[a-zA-Z0-9]+$",
"AZURE2": "^[a-zA-Z0-9]{75}AZDO.{4}$",
"NPM": "^npm_[a-zA-Z0-9-]{36}$",
"JWT": "^ey[a-zA-Z0-9/+=.]+$",
"JFROG": "^AKCp[a-zA-Z0-9]{69}$",
"RUBY": "^rubygems_[a-zA-Z0-9]+$",
"NUGET": "^oy2[a-zA-Z0-9]+$",
"DOCKER": "^dckr_pat_[a-zA-Z0-9]+$",
"CIRCLECI": "^CCIPAT_[a-zA-Z0-9]+$",
"BUILDKITE": "^bkua_[a-zA-Z0-9]+$",
"ACCTOK": "^[ps]at\.[a-zA-Z0-9.]+$",
"CF": "^(?:cfk|cfut|cfat)_[a-zA-Z0-9]+$",
"PULUMI": "^pul-[a-zA-Z0-9]{40}$",
"HASHICORP": "^(?:hvs|hvb|hvr)\.[a-zA-Z0-9/+=]+$",
"ONEPASS": "^ops_[a-zA-Z0-9/+=.]+$",
"OPENAPI": "^sk-(?:(?:svcacct|proj)-)?[A-Za-z0-9-]+$",
"DOPPLER": "^dp\.(?:ct|pt|st|sa|said|scim|audit)\.[a-zA-Z0-9]+$",
"INFISICAL": "^st\.[a-zA-Z0-9/+=.]+$",
"DDOG": "^ddapp_[a-zA-Z0-9]{34}$",
"NEW_RELIC": "^NRAK-[a-zA-Z0-9]{27}$",
"NEW_RELIC2": "^NRII-[A-Za-z0-9-_]{32}$",
"GRAFANA": "^glc_[a-zA-Z0-9/+=]+$",
"GRAFANA2": "^glsa_[a-zA-Z0-9_-]+$",
"HONEYCOMB": "^(?:hcxik|hcxlk|hcxmk)_[a-zA-Z0-9_:]+$",
"SENTRY": "^sntrys_[a-zA-Z0-9]+$",
"DYNATRACE": "^dt0s(?:01|02|06|16)\.[a-zA-Z0-9]{24}\.[a-zA-Z0-9]{64}$",
"ALPHANUM32": "^[a-zA-Z0-9]{32}$",
"HEX": "^[A-Fa-f0-9]+$",
"AXIOM": "^(?:xapt|xaat)-[a-zA-Z0-9-]+$",
"SLACK": "^xox[bpace]-[a-zA-Z0-9]+$",
"SENDGRID": "^SG\.\S{66}$",
"MAILGUN": "^key-[0-9a-fA-F]{32}$",
"MAILCHIMP": "^[0-9a-fA-F]{32}-\S+$",
"RESEND": "^re_[a-zA-Z0-9]+$",
"TWILIO1": "^AC[A-Fa-f0-9]+$",
"TWILIO2": "^SK[a-zA-Z0-9]{32}$",
"VONAGE": "^[a-z0-9]{8}$",
"AUTH0": "^\S{64}$",
"OKTA": "^00[A-Za-z0-9-]{40}$",
"FIREBASE": "^AIza[A-Za-z0-9_-]{35}$",
"KEYCLOAK": "^[a-z0-9_.-]+$",
"FAUNA": "^(?:fn|[A-Z])[A-Z0-9]+$",
"AIRTABLE": "^pat\S{14}\.\S{64}$",
"STRIPE": "^[srp]k_(?:live|test)_[a-zA-Z0-9]+$",
"STRIPE2": "^whsec_[a-zA-Z0-9/+=]+$",
"BRAINTREE": "^[a-zA-Z0-9]{16}$",
"SQUARE": "^EAAA[-0-9a-zA-Z+=]{60}$",
"PLAID": "^[a-z0-9]{30}$",
"AKAMAI": "^akab-[a-zA-Z0-9]+$",
"NETLIFY": "^nf[pcoub][a-zA-Z0-9]+$",
"VERCEL": "^vc[piar]_[a-zA-Z0-9]+$",
"FLY": "^(?:FlyV1\s+)?fm2_[A-Za-z0-9+/=]+$",
"RENDER": "^rnd_[a-zA-Z0-9]{32}$",
"SONAR": "^sq(?:u|p|a|b|co)_\S+$",
"WIZ": "^[a-zA-Z0-9]{64}$",
"ANTHROPIC": "^sk-ant-(?:(?:api03|oat01)-)?[A-Za-z0-9-]+$",
"HF": "^hf_[a-zA-Z0-9]+$",
"GROQ": "^gsk_[a-zA-Z0-9]+$",
"REPLICATE": "^r8_[a-zA-Z0-9]{37}$",
"LONGCHAIN": "^lsv_[a-zA-Z0-9]+$",
"LANGSMITH": "^ls(v2)?_[a-zA-Z0-9_-]+$",
"POSTHOG": "^phx_[a-zA-Z0-9]+$",
"STATSIG": "^secret-[a-zA-Z0-9]+$",
"CLOUD1": "^\d{15}$",
"CLOUD2": "^[a-zA-Z0-9]{27}$",
"MAPBOX": "^[pst]k\.[a-zA-Z0-9/+=]+\.[a-zA-Z0-9/+=]+$",
"PUSHER": "^[0-9a-z]{20}$",
"ABLY": "^[a-zA-Z0-9/+=]{6}\.[a-zA-Z0-9/+=]{6}:[a-zA-Z0-9/+=]+$"
};
var env_vars = {
"AWS_SECRET_ACCESS_KEY" : "BASE64",
"AWS_ACCESS_KEY_ID" : "AWS1",
"AWS_SESSION_TOKEN" : "BASE64",
"AWS_PROFILE" : "AWS2",
"AWS_SHARED_CREDENTIALS_FILE" : "ALL",
"AWS_WEB_IDENTITY_TOKEN_FILE" : "ALL",
"AZURE_CLIENT_ID" : "UUID",
"AZURE_CLIENT_SECRET" : "ALL",
"AZURE_CLIENT_CERTIFICATE_PASSWORD" : "ALL",
"AZURE_CLIENT_CERTIFICATE_PATH" : "ALL",
"AZURE_PASSWORD" : "ALL",
"AZURE_USERNAME" : "AZURE1",
"ARM_CLIENT_ID" : "UUID",
"ARM_CLIENT_SECRET" : "ALL",
"GOOGLE_APPLICATION_CREDENTIALS" : "ALL",
"GOOGLE_CREDENTIALS" : "ALL",
"GOOGLE_OAUTH_ACCESS_TOKEN" : "OAUTH",
"CLOUDSDK_AUTH_TOKEN_FILE" : "ALL",
"OCI_CLI_KEY_FILE" : "ALL",
"OCI_CLI_SECURITY_TOKEN_FILE" : "ALL",
"OCI_RESOURCE_PRINCIPAL_PRIVATE_PEM" : "ALL",
"IBMCLOUD_API_KEY" : "OAUTH",
"IC_USER_NAME" : "NOSPACE",
"IC_API_KEY" : "ALL",
"BM_API_KEY" : "ALL",
"BLUEMIX_API_KEY" : "ALL",
"SOFTLAYER_USERNAME" : "NOSPACE",
"SL_USERNAME" : "NOSPACE",
"SIMPLELOGIN_API_KEY" : "ALL",
"SL_API_KEY" : "ALL",
"ALIBABACLOUD_ACCESS_KEY_ID" : "ALIACC",
"ALIBABACLOUD_ACCESS_KEY_SECRET" : "ALPHANUM",
"ALIBABACLOUD_SECURITY_TOKEN" : "ALISTS",
"ALICLOUD_ACCESS_KEY" : "ALIACC",
"ALICLOUD_SECRET_KEY" : "ALPHANUM",
"ALICLOUD_SECURITY_TOKEN" : "ALISTS",
"AWS_CLIENT_ID" : "ALPHANUM",
"AWS_CLIENT_SECRET" : "ALPHANUM",
"GITHUB_TOKEN" : "GH_TOKEN1",
"GH_TOKEN" : "GH_TOKEN1",
"GITHUB_PAT" : "GH_TOKEN1",
"GITHUB_ACCESS_TOKEN" : "GH_TOKEN1",
"GITLAB_TOKEN" : "GH_TOKEN2",
"GITLAB_PRIVATE_TOKEN" : "GH_TOKEN2",
"BITBUCKET_TOKEN" : "ALL",
"BITBUCKET_APP_PASSWORD" : "ALL",
"BITBUCKET_USERNAME" : "ALL",
"AZURE_DEVOPS_TOKEN" : "AZURE2",
"SYSTEM_ACCESSTOKEN" : "OAUTH",
"NPM_TOKEN" : "NPM",
"NODE_AUTH_TOKEN" : "NPM",
"JFROG_ACCESS_TOKEN" : "JWT",
"ARTIFACTORY_TOKEN" : "BASE64",
"ARTIFACTORY_API_KEY" : "JFROG",
"ARTIFACTORY_USER" : "ALL",
"ARTIFACTORY_PASSWORD" : "ALL",
"NEXUS_USERNAME" : "ALL",
"NEXUS_PASSWORD" : "ALL",
"NEXUS_TOKEN" : "ALL",
"OSSRH_USERNAME" : "ALL",
"OSSRH_PASSWORD" : "ALL",
"OSSRH_TOKEN" : "ALL",
"PYPI_TOKEN" : "ALL",
"TWINE_USERNAME" : "ALL",
"TWINE_PASSWORD" : "ALL",
"RUBYGEMS_API_KEY" : "ALPHANUM",
"GEM_HOST_API_KEY" : "RUBY",
"CARGO_REGISTRY_TOKEN" : "ALL",
"NUGET_API_KEY" : "ALL",
"GRADLE_PUBLISH_KEY" : "ALL",
"GRADLE_PUBLISH_SECRET" : "ALL",
"DOCKERHUB_USERNAME" : "ALL",
"DOCKERHUB_TOKEN" : "DOCKER",
"DOCKER_USERNAME" : "ALL",
"DOCKER_PASSWORD" : "ALL",
"QUAY_USERNAME" : "ALL",
"QUAY_PASSWORD" : "ALL",
"QUAY_TOKEN" : "ALL",
"CIRCLE_TOKEN" : "ALL",
"CIRCLECI_TOKEN" : "CIRCLECI",
"TRAVIS_TOKEN" : "OAUTH",
"TRAVIS_CI_TOKEN" : "OAUTH",
"BUILDKITE_AGENT_TOKEN" : "UUID",
"BUILDKITE_API_ACCESS_TOKEN" : "BUILDKITE",
"DRONE_TOKEN" : "JWT",
"HARNESS_API_KEY" : "ACCTOK",
"TEAMCITY_TOKEN" : "JWT",
"SEMAPHORE_API_TOKEN" : "ALL",
"CF_API_KEY" : "CF",
"PULUMI_ACCESS_TOKEN" : "PULUMI",
"TF_API_TOKEN" : "ALL",
"TF_TOKEN_app_terraform_io" : "ALL",
"VAULT_TOKEN" : "HASHICORP",
"CONSUL_HTTP_TOKEN" : "UUID",
"NOMAD_TOKEN" : "UUID",
"OP_SERVICE_ACCOUNT_TOKEN" : "ONEPASS",
"OP_API_TOKEN" : "OPENAPI",
"DOPPLER_TOKEN" : "DOPPLER",
"INFISICAL_TOKEN" : "INFISICAL",
"DD_API_KEY" : "ALPHANUM",
"DD_APP_KEY" : "DDOG",
"DATADOG_API_KEY" : "ALPHANUM",
"NEW_RELIC_LICENSE_KEY" : "ALPHANUM",
"NEW_RELIC_API_KEY" : "NEW_RELIC",
"NEW_RELIC_INSERT_KEY" : "NEW_RELIC2",
"SPLUNK_TOKEN" : "UUID",
"SPLUNK_HEC_TOKEN" : "UUID",
"GRAFANA_API_KEY" : "GRAFANA",
"GRAFANA_TOKEN" : "GRAFANA2",
"LOKI_URL" : "ALL",
"HONEYCOMB_API_KEY" : "HONEYCOMB",
"SENTRY_AUTH_TOKEN" : "SENTRY",
"DYNATRACE_API_TOKEN" : "DYNATRACE",
"DT_API_TOKEN" : "DYNATRACE",
"ELASTIC_APM_SECRET_TOKEN" : "ALL",
"ELASTIC_APM_API_KEY" : "BASE64",
"SIGNALFX_ACCESS_TOKEN" : "ALPHANUM",
"LOGZIO_TOKEN" : "ALPHANUM32",
"ROLLBAR_ACCESS_TOKEN" : "HEX",
"BUGSNAG_API_KEY" : "HEX",
"APPDYNAMICS_AGENT_ACCOUNT_ACCESS_KEY" : "ALL",
"APPDYNAMICS_ACCOUNT_NAME" : "ALL",
"LS_ACCESS_TOKEN" : "ALPHANUM",
"LS_STUDIO_ACCESS_TOKEN" : "ALPHANUM",
"LS_STUDIO_API_KEY" : "ALPHANUM",
"AXIOM_TOKEN" : "AXIOM",
"SLACK_TOKEN" : "SLACK",
"SLACK_BOT_TOKEN" : "SLACK",
"SLACK_APP_TOKEN" : "SLACK",
"DISCORD_TOKEN" : "ALL",
"DISCORD_BOT_TOKEN" : "ALL",
"PAGERDUTY_TOKEN" : "OAUTH",
"PAGERDUTY_API_KEY" : "ALL",
"PAGERDUTY_INTEGRATION_KEY" : "ALPHANUM",
"OPSGENIE_API_KEY" : "UUID",
"VICTOROPS_API_KEY" : "ALPHANUM",
"VICTOROPS_ROUTING_KEY" : "ALL",
"SENDGRID_API_KEY" : "SENDGRID",
"MAILGUN_API_KEY" : "MAILGUN",
"POSTMARK_API_TOKEN" : "UUID",
"POSTMARK_SERVER_TOKEN" : "ALL",
"MAILCHIMP_API_KEY" : "MAILCHIMP",
"MANDRILL_API_KEY" : "ALPHANUM",
"RESEND_API_KEY" : "RESEND",
"TWILIO_ACCOUNT_SID" : "TWILIO1",
"TWILIO_AUTH_TOKEN" : "ALPHANUM32",
"TWILIO_API_KEY" : "TWILIO2",
"TWILIO_API_SECRET" : "ALPHANUM32",
"VONAGE_API_KEY" : "VONAGE",
"VONAGE_API_SECRET" : "ALPHANUM",
"AUTH0_CLIENT_SECRET" : "AUTH0",
"AUTH0_MANAGEMENT_API_TOKEN" : "JWT",
"OKTA_API_TOKEN" : "OKTA",
"OKTA_CLIENT_SECRET" : "ALPHANUM",
"FIREBASE_API_KEY" : "FIREBASE",
"KEYCLOAK_CLIENT_ID" : "KEYCLOAK",
"KEYCLOAK_CLIENT_SECRET" : "UUID",
"JWT_SECRET" : "ALL",
"JWT_SECRET_KEY" : "ALL",
"PGPASSWORD" : "ALL",
"PGUSER" : "ALL",
"MYSQL_PASSWORD" : "ALL",
"MYSQL_ROOT_PASSWORD" : "ALL",
"MYSQL_USER" : "ALL",
"MONGO_INITDB_ROOT_USERNAME" : "ALL",
"MONGO_INITDB_ROOT_PASSWORD" : "ALL",
"REDIS_PASSWORD" : "ALL",
"ELASTIC_PASSWORD" : "ALL",
"FAUNA_SECRET" : "FAUNA",
"NEON_API_KEY" : "ALL",
"TURSO_AUTH_TOKEN" : "JWT",
"AIRTABLE_API_KEY" : "AIRTABLE",
"STRIPE_SECRET_KEY" : "STRIPE",
"STRIPE_PUBLISHABLE_KEY" : "STRIPE",
"STRIPE_WEBHOOK_SECRET" : "STRIPE2",
"PAYPAL_CLIENT_SECRET" : "ALPHANUM",
"BRAINTREE_PUBLIC_KEY" : "BRAINTREE",
"BRAINTREE_PRIVATE_KEY" : "ALL",
"SQUARE_ACCESS_TOKEN" : "SQUARE",
"PLAID_SECRET" : "PLAID",
"CLOUDFLARE_API_TOKEN" : "ALPHANUM",
"CLOUDFLARE_API_KEY" : "ALPHANUM",
"CF_API_TOKEN" : "ALPHANUM",
"FASTLY_API_KEY" : "ALL",
"AKAMAI_CLIENT_TOKEN" : "AKAMAI",
"AKAMAI_CLIENT_SECRET" : "BASE64",
"AKAMAI_ACCESS_TOKEN" : "ALL",
"NETLIFY_AUTH_TOKEN" : "NETLIFY",
"VERCEL_TOKEN" : "VERCEL",
"FLY_API_TOKEN" : "FLY",
"HEROKU_API_KEY" : "UUID",
"RAILWAY_TOKEN" : "ALL",
"RENDER_API_KEY" : "RENDER",
"SNYK_TOKEN" : "UUID",
"SONAR_TOKEN" : "SONAR",
"FOSSA_API_KEY" : "ALL",
"VERACODE_API_KEY" : "ALL",
"WS_APIKEY" : "ALPHANUM",
"WS_USERKEY" : "ALPHANUM",
"CX_TOKEN" : "JWT",
"CHECKMARX_PASSWORD" : "ALL",
"LW_API_KEY" : "ALPHANUM",
"LW_API_SECRET" : "ALL",
"WIZ_CLIENT_ID" : "ALPHANUM",
"WIZ_CLIENT_SECRET" : "WIZ",
"PCC_ACCESS_KEY_ID" : "UUID",
"PCC_SECRET_KEY" : "ALL",
"OPENAI_API_KEY" : "OPENAPI",
"ANTHROPIC_API_KEY" : "ANTHROPIC",
"HF_TOKEN" : "HF",
"HUGGINGFACE_TOKEN" : "HF",
"HUGGINGFACE_HUB_TOKEN" : "HF",
"COHERE_API_KEY" : "ALL",
"MISTRAL_API_KEY" : "ALPHANUM",
"GROQ_API_KEY" : "GROQ",
"REPLICATE_API_TOKEN" : "REPLICATE",
"STABILITY_API_KEY" : "OPENAPI",
"TOGETHER_API_KEY" : "OPENAPI",
"WANDB_API_KEY" : "ALPHANUM",
"LANGCHAIN_API_KEY" : "LANGSMITH",
"LANGSMITH_API_KEY" : "LANGSMITH",
"SEGMENT_WRITE_KEY" : "ALPHANUM32",
"MIXPANEL_TOKEN" : "ALPHANUM32",
"AMPLITUDE_API_KEY" : "HEX",
"POSTHOG_API_KEY" : "POSTHOG",
"LAUNCHDARKLY_SDK_KEY" : "ALL",
"LD_SDK_KEY" : "ALL",
"SPLIT_SDK_KEY" : "ALPHANUM",
"SPLIT_IO_API_KEY" : "ALPHANUM",
"STATSIG_SECRET_KEY" : "STATSIG",
"STATSIG_SERVER_SECRET_KEY" : "STATSIG",
"UNLEASH_API_TOKEN" : "ALL",
"CLOUDINARY_API_KEY" : "CLOUD1",
"CLOUDINARY_API_SECRET" : "CLOUD2",
"MAPBOX_ACCESS_TOKEN" : "MAPBOX",
"ALGOLIA_API_KEY" : "ALPHANUM32",
"ALGOLIA_ADMIN_API_KEY" : "ALPHANUM32",
"ALGOLIA_SEARCH_API_KEY" : "ALPHANUM32",
"PUSHER_APP_KEY" : "PUSHER",
"PUSHER_APP_SECRET" : "ALPHANUM32",
"ABLY_API_KEY" : "ABLY",
"SECRET_KEY" : "ALL",
"APP_SECRET" : "ALL",
"API_KEY" : "ALL",
"API_TOKEN" : "ALL",
"AUTH_TOKEN" : "ALL",
"ACCESS_TOKEN" : "ALL",
"WEBHOOK_SECRET" : "ALL",
"PRIVATE_KEY" : "ALL",
"CLIENT_ID" : "ALL",
"CLIENT_SECRET" : "ALL",
"SIGNING_SECRET" : "ALL",
"ENCRYPTION_KEY" : "ALL",
"TOKEN" : "ALL"
};
var host_env_vars = get_discovered_environment_variables();
host_env_vars = host_env_vars["variables"];
if(empty_or_null(host_env_vars))
audit(AUDIT_HOST_NONE, "environment variables");
var report;
var regex, re_name, name, user, path, props;
for(var ev of host_env_vars)
{
name = ev["name"];
re_name = env_vars[name];
if(isnull(re_name))
continue;
regex = cred_regexes[re_name];
if(isnull(regex))
{
dbg::detailed_log(lvl:1, src:SCRIPT_NAME,
msg:"Unexpected: A credential environment variable was found with no pattern.");
continue;
}
if(ev["value"] !~ regex)
{
dbg::detailed_log(lvl:3,
src:SCRIPT_NAME,
msg:"An environment variable secret was found which doesn't match the expected pattern.",
msg_details:{"name":{"lvl":2, "value":name}, "regex":{"lvl":3, "value":regex}});
continue;
}
user = ev["user"];
path = ev["source_path"];
report += "User: " + user + '\n' +
"Variable name: " + name + '\n' +
"Source: " + path + '\n\n';
}
if(empty_or_null(report))
audit(AUDIT_HOST_NONE, "sensitive data, secrets or API tokens in its environment variables");
security_report_v4(port:0, severity:SECURITY_HOLE, extra:report);
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
14 Sep 2026 00:00Current
5.8Medium risk
Vulners AI Score5.8