All checks
Critical
CodeBuild Bitbucket source repository URLs should not contain sensitive credentials
Checks that a CodeBuild project's primary source URL has no user name or password before the host, as in https://user:token@host/repo. Anyone who can read the project can read that credential, so it needs revoking as well as removing. Secondary sources, and a token in the path or query string, are not read.
- service
- CodeBuild
- severity
- Critical
- scope
- evaluated in every region
How to fix it
- Can break clients: Set up the credential before editing the URL or the next build cannot clone; then revoke the old token, which also stops anything else still using it.
In the console
CodeBuild → Build projects → the project → Edit → Source
- Credential
- Default source credential or Custom source credential (a connection or a Secrets Manager secret)
- Repository
- The repository URL alone, with no user name or token before the host
See which of your accounts this check is failing on.
Book a live scan