API key exposure introduces security vulnerabilities to hosted applications.
Store API keys securely, avoiding plaintext storage.
Avoid plain text storage within application code or application source trees.
Check
Verify the API is configured to provide protected storage for API keys, ensuring they are encrypted at rest using cryptographic mechanisms that comply with NIST-approved algorithms and key management standards (e.g., AES-256, FIPS 140-3 validated modules). Protected storage must prevent unauthorized access, tampering, or disclosure of keys, and must enforce access controls consistent with the principle of least privilege. This includes storing keys in secure vaults, hardware security modules (HSMs), or encrypted databases.
If the API is not configured to provide protected storage for API keys, this is a finding.
Fix
Build or configure the API to provide protected storage using cryptographic mechanisms that comply with NIST-approved algorithms and key management standards (e.g., AES-256, FIPS 140-3 validated modules) for API keys.