Cryptographic Key Material Exposure
Overview
Private keys and key material committed to version control or hardcoded in source permanently compromise:
- TLS certificates (can intercept all encrypted traffic)
- SSH keys (unauthorized server access)
- JWT signing keys (forge authentication tokens)
- PGP keys (decrypt private communications)
Remediation
- Use
.gitignoreto exclude all key files - Rotate any exposed keys immediately — treat them as compromised
- Use secrets management systems (Vault, AWS Secrets Manager)
- Use hardware security modules (HSM) for production key storage