Secrets committed to source

What it is

A secret checked into git is a secret published to the world. The attack is as simple as `git clone` and `grep`. Removing the secret later does not fix it because the value lives on in history, in every fork, and in every mirror. The canonical shapes are `AKIA…` AWS keys, `ghp_…` GitHub PATs, `sk_live_…` Stripe keys, `xox[bap]-…` Slack tokens, and PEM-formatted private keys.

Why it matters for MCP

MCP servers frequently need credentials to talk to backend APIs — GitHub, Slack, databases, cloud providers. Authors reach for the easiest option (drop the key in a constant, or in a `.env.example` that somehow became `.env`) because it works during development. When the repo is made public or installed by another user, the credential goes with it, granting whoever installed the package access to the author's real accounts.

Vulnerable example

# config.py — committed to the public repo

STRIPE_SECRET = "sk_live_4eC39HqLyjWDarjtT1zdp7dc"

AWS_SECRET_ACCESS_KEY = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"

GITHUB_TOKEN = "ghp_abcdef1234567890abcdef1234567890abcd"

Secure example

# config.py — reads from environment; nothing sensitive at rest in the repo.

import os

STRIPE_SECRET = os.environ["STRIPE_SECRET"]

AWS_SECRET_ACCESS_KEY = os.environ["AWS_SECRET_ACCESS_KEY"]

GITHUB_TOKEN = os.environ["GITHUB_TOKEN"]

# In production, load these from a secrets manager (AWS SSM, Vault, 1Password

# Connect, etc.) and rotate aggressively. Never commit an .env with real values.

How MCPSafe detects this

We match canonical credential prefixes (AWS `AKIA`, GitHub `ghp_`/`gho_`, Stripe `sk_live_`, Slack `xox[bap]-`, Google `AIza`), PEM private-key headers, and high-entropy base64 assigned to variables named `api_key`, `secret`, `token`, or `password`. Common placeholder values (`xxx`, `changeme`, `your-key`, `<REDACTED>`) are excluded to keep the false-positive rate low.

See the full threat catalog for every documented detection.

Framework alignment

OWASP LLM Top-10 (2025)

LLM02 — Sensitive Information Disclosure

OWASP Agentic AI Top-10

T09 — Identity Spoofing

AIVSS v0.5

8.9 (HIGH)AIVSS:1.0/S:HIGH/AV:N/AU:N/BR:H/CD:D

Further reading

• CWE-798: Use of Hard-coded Credentials
• GitHub: Secret scanning