diff --git a/rules/S6753/secrets/rule.adoc b/rules/S6753/secrets/rule.adoc index 64172842736..18762c84cea 100644 --- a/rules/S6753/secrets/rule.adoc +++ b/rules/S6753/secrets/rule.adoc @@ -1,3 +1,6 @@ +Zuplo is an API management platform built for developers. It handles authentification and access to your API and provides additional functionalities such as rate limiting the number of requests to your backend. +In order for your backend to validate that a request has been processed by Zuplo, it relies on an API key generated in Zuplo Developer Portal. If this key is compromised, attackers will be able to bypass Zuplo and access your API without authentication and authorization. + include::../../../shared_content/secrets/description.adoc[] == Why is this an issue? @@ -6,7 +9,7 @@ include::../../../shared_content/secrets/rationale.adoc[] === What is the potential impact? -Below are some real-world scenarios that illustrate some impacts of an attacker exploiting the credentials. +The exact impact of a Zuplo API key being leaked varies greatly depending on the type of services the software is used to implement. In general, consequences ranging from a denial of service to application compromise can be expected. :secret_type: credentials @@ -14,8 +17,6 @@ include::../../../shared_content/secrets/impact/codeless_vulnerability_chaining. include::../../../shared_content/secrets/impact/data_compromise.adoc[] -include::../../../shared_content/secrets/impact/suspicious_activities_termination.adoc[] - == How to fix it