Description

Ensure passwords, API keys, tokens, and connection strings are not written as literal values in render.yaml files or source code. In render.yaml, secrets should use sync: false (so the value is entered in the dashboard), fromDatabase, fromService, generateValue, or an environment group.

Rationale

Anything committed to a Git repository can be read by everyone with repository access, copied into forks, and stays in the Git history even after it is deleted. Secrets stored this way are easy to leak. Keeping them out of the repository, and setting them in Render instead, prevents this.

Impact

  • Secrets are not exposed through the Git repository

  • Secrets can be rotated without code changes

  • Leaked secrets must be rotated and removed from history

Default Value

Render does not block literal secret values in render.yaml.

Pre-Requisites

  • Access to the repositories that contain render.yaml and application code

Remediation

Test Plan

  1. Search each repository's render.yaml and source code for literal secrets, for example with a secret scanner such as gitleaks or trufflehog, or GitHub secret scanning.

  2. In render.yaml, check every envVars entry that holds a secret and confirm it uses sync: false, fromDatabase, fromService, generateValue, or an environment group instead of value:.

  3. If any literal secret is found, follow the implementation steps.

Implementation Steps

  1. Rotate the exposed secret with its provider first, because it must be treated as leaked.

  2. In render.yaml, replace the literal value: with sync: false (then enter the value in the Render Dashboard), or use fromDatabase, fromService, generateValue, or an environment group.

  3. Remove secrets from source code and read them from environment variables instead.

  4. Commit the change, and remove the secret from Git history if your policy requires it.

Backout Plan

  1. Revert the render.yaml change in Git if a deploy fails, and set the value in the Render Dashboard instead of committing it.

Reference