Skip to main content

SQ34201

Detected presence of version control tool artifacts.

priorityCI/CD statusseverityeffortRL levelRL assessment
failhighlow1secrets: fail
Reason: source control artifacts found

About the issue​

Source Code Management (SCM) tools provide version control tracking for application source code. They track development histories for each source code unit, and store them in a version-control-specific database format. For convenience, the source code repository and its version control database typically reside in the same folder. Because some programming languages package source code as an artifact during the build, it is possible to misconfigure the packaging step and include the version control database. Contents of this database include all historic changes for the version control tracked repository. This includes private keys, certificates, and other sensitive information that should be kept secret. Given the access to a version control database, an attacker could use its artifacts to extract sensitive information, and gain privileged access.

How to resolve the issue​

  • Remove all version control databases and their artifacts from the package before you release it.

Incidence statistics​

ReversingLabs periodically collects and analyzes the contents of popular software package repositories for threat research purposes.

For every repository, the chart shows the percentage of projects that triggered the software assurance policy. In other words, it shows how many projects were found to have the specific issue described on this page.

The percentages are calculated from the total amount of packages analyzed:

  • RubyGems: 174K
  • Nuget: 189K
  • PyPi: 403K
  • NPM: 2.1M