CodeBuild Bitbucket source repository URLs should not contain sensitive credentials
Flags CodeBuild projects whose source repository URL carries credentials in it, for example https://user:token@host/repo. The check reads the URL only; it does not inspect how the project authenticates, so a project using a stored source credential or OAuth passes whether or not that is what it uses.
- service
- CodeBuild
- severity
- Critical
- scope
- evaluated in every region
How to fix it
Have the named project's source location hold the repository address alone, with no user name or password in front of the host. Give the project another way to authenticate first, a source credential stored for that provider or a connection the project refers to, or its next build cannot clone the repository. Then revoke the credential that was in the URL: it has been readable by everyone able to read the project, so removing it from the URL alone leaves a live credential someone has already seen.
In the console
CodeBuild → Build projects → the project → Edit → Source
See which of your accounts this check is failing on.
Book a demo