{ "schemaVersion": "1.0.0", "kind": "editorial-inspection-pack", "provenance": "editorial-guidance", "guideId": "secrets-and-rotation", "updatedAt": "2026-11-12", "catalogVersion": "0.11.0", "sourceRepository": "https://github.com/sakimyto/security-knowledge", "sourceLicense": "MIT", "catalogHash": "e99906d58134e7e0d33d994548277ae7814000d92c088aa5894c49b62ae60cca", "catalogReviewedAt": "2026-11-09", "execution": "read-only-by-default", "selectedRuleIds": ["SEC-004", "SEC-005"], "deferredRuleIds": [ "SEC-001", "SEC-002", "SEC-003", "SEC-006", "SEC-007", "SEC-008", "SEC-009", "SEC-010", "SEC-011", "SEC-012", "SEC-013", "SEC-014", "SEC-015", "SEC-016" ], "outsideSelectionStatus": "unverified", "resultStatuses": ["finding", "no-finding", "not-applicable", "unverified"], "reportSchemaUrl": "https://sakimyto.com/security-data/report.schema.json", "reportExampleUrl": "https://sakimyto.com/security-data/report.example.json", "catalogDiscoveryUrl": "https://sakimyto.com/security-data/discovery.json", "distributionIndexUrl": "https://sakimyto.com/security-learning-data/index.json", "requiredRuleIndex": [ { "id": "SEC-001", "hash": "efec3489e1663249a2aff75cdb7c25e82d9765acb2bdcfa31e8ee934f12ef626" }, { "id": "SEC-002", "hash": "1398f1a8c28e4441472ef3a0952fde97c4ff19b5010178989f4ddd05b6a193dd" }, { "id": "SEC-003", "hash": "00aa6c368be21452c79e662728102938d7d3896073e53de74ea5fc913250b808" }, { "id": "SEC-004", "hash": "4c8742376f6fe13cb33908f282d1a6af6fd73ae0a13007f8013ca7042fd629b4" }, { "id": "SEC-005", "hash": "695e2e119a1364887732e6ee90c1250d22063f1e6e0ec71746e80b7231ace15f" }, { "id": "SEC-006", "hash": "a3cc524b847c5ec9223ea64ed01920283062fe3fcd0eaf2595bde44f951eed71" }, { "id": "SEC-007", "hash": "154186523c183ea0ec0059b951eb9b35f0ac41557c28df13c071663be3aef6ee" }, { "id": "SEC-008", "hash": "ab2bd7e87128a2ce571578558337ab8577fcda20f841171dba5b45d732ad2f03" }, { "id": "SEC-009", "hash": "8b9d4f314306ca656f73c115c195d84dd803e8a58a53355ed03516b330b26cb2" }, { "id": "SEC-010", "hash": "66b39f4eb8a0f334e98e9388e3f9dab27415e726c0862f0b6a4a4dd10e5e81df" }, { "id": "SEC-011", "hash": "3ae198ddd5fa82a53bcbca648d3a9070b03e3cd5665387e69e50c6bb6d365cb3" }, { "id": "SEC-012", "hash": "2da99baf28980f61385469445d6c000edb5434471a4a3500f1775ca78467824a" }, { "id": "SEC-013", "hash": "630183526a6d030807db345f6214176c12ca911fb261bde3abebc1c355a21d98" }, { "id": "SEC-014", "hash": "d9142da38fbe305f72d506a6d6c3c97f658fa446587dc9b27657622c880c1163" }, { "id": "SEC-015", "hash": "1dfd83077658a79d47897d199f646eb9f69aa4d92c7646c57f2b82a715fde44c" }, { "id": "SEC-016", "hash": "cce435bbacb6fef88c9e9d661222b081d8463e4f025448a7796cdcddd7548488" } ], "boundary": { "ja": "選択した2ルールだけを、許可された対象で読み取り点検します。残る14ルールは実行せず、既存の結果形式へunverifiedと範囲外の理由を残します。資料を読むだけで合格にせず、秘密の実値・変更・外部送信の権限は増やしません。", "en": "Inspect only the two selected rules in authorized scope, read-only. Leave the other fourteen unperformed and report them as unverified with an out-of-scope reason under the existing contract. Reading guidance is not a pass and grants no authority to expose secrets, modify systems, or send data." }, "guide": { "id": "secrets-and-rotation", "title": { "ja": "秘密の値を開かず、置き場所と失効を見る", "en": "Review secret handling without opening values" }, "lead": { "ja": "混入する経路と、交換後に古い資格情報を止める経路を整理します。", "en": "Map exposure paths and the process for invalidating old credentials after replacement." }, "situation": { "ja": "公開成果物やサポート添付があり、鍵の利用先も複数あるとき。", "en": "Use this when public artifacts or support attachments coexist with credentials used by several services." }, "goal": { "ja": "秘密情報が通る場所と、更新・失効を確認した範囲を、値なしで残します。", "en": "Record secret-handling paths and the verified replacement and invalidation scope without storing values." }, "ruleIds": ["SEC-004", "SEC-005"], "incidentIds": ["toyota-github-2022", "cloudflare-thanksgiving-2023"], "termIds": ["secret", "revocation", "asset"], "sourceIds": ["secrets", "ci"], "steps": [ { "title": { "ja": "値を持たない台帳を作る", "en": "Start with non-secret identifiers" }, "action": { "ja": "用途・管理者・対象環境・利用先を既存台帳から読み、実値は収集しません。", "en": "Read purpose, owner, environment, and consumers from the existing inventory without collecting values." }, "evidence": { "ja": "秘密の値を含まない識別子と利用先の対応。", "en": "Non-secret identifiers mapped to their consumers." } }, { "title": { "ja": "配るものを起点に見る", "en": "Trace distributed material" }, "action": { "ja": "リポジトリだけでなく、ビルド結果と診断用添付を作る工程の検査記録も読みます。", "en": "Review checks on build output and diagnostic attachment generation as well as the repository." }, "evidence": { "ja": "対象成果物の識別子、検査範囲、未検査の経路。", "en": "Artifact identities, checked scope, and unexamined paths." } }, { "title": { "ja": "交換と失効を分ける", "en": "Separate replacement from invalidation" }, "action": { "ja": "更新先への反映と旧鍵の拒否を、対応履歴や承認済み試験から別々に確認します。", "en": "Review consumer updates and rejection of old keys separately using response history or authorized test records." }, "evidence": { "ja": "更新した先と、旧鍵の失効を確認した先の一覧。", "en": "The consumers updated and the systems where old-key invalidation was verified." } } ], "limits": [ { "ja": "検査で見つけた秘密の実値は、メモ・依頼文・公開レポートへ移しません。", "en": "Do not copy discovered secret values into notes, prompts, or public reports." }, { "ja": "運用中の鍵の交換や失効は、この読み取り点検の許可には含めません。", "en": "Replacement or revocation of active credentials is outside this read-only review." } ], "takeaway": { "ja": "「新しい鍵が使える」と「古い鍵が使えない」は別の確認です。", "en": "A working new credential and a rejected old credential are separate observations." } }, "rules": [ { "rule": { "id": "SEC-004", "version": "1.1.0", "updatedAt": "2026-10-09", "title": { "ja": "配布物と添付ファイルへの秘密情報の混入を確認する", "en": "Inspect artifacts and attachments for secret inclusion" }, "summary": { "ja": "コード・ビルド成果物・コンテナ・サポート資料を保存または配布する環境。", "en": "Environments storing or distributing code, artifacts, containers, or support material." }, "category": "credentials", "surfaces": ["repositories", "containers", "ci", "support"], "applicability": { "ja": "コード・ビルド成果物・コンテナ・サポート資料を保存または配布する環境。", "en": "Environments storing or distributing code, artifacts, containers, or support material." }, "targets": [ { "ja": "公開設定・Git履歴・配布用の成果物", "en": "Visibility settings, Git history, distribution artifacts" }, { "ja": "Dockerfile・中間レイヤー・CIログ・添付手順", "en": "Dockerfiles, image layers, CI logs, attachment procedures" } ], "checks": [ { "ja": "許可されたスキャナーで確認し、ファイル・位置・種類だけを記録する。秘密の実値や環境変数全体を出力しない。", "en": "Use authorized scanners; record only location and type, never secret values or whole environments." }, { "ja": "最終ファイルを削除してもGit履歴やイメージのレイヤーに残らないか、配布対象全体を確認する。", "en": "Check Git history and image layers as well as the final filesystem." } ], "remediation": [ { "ja": "ビルド時の秘密はsecret mount等に移し、ログと添付の除去処理を整備する。漏洩した鍵はSEC-005で失効を確認する。", "en": "Use build-time secret mechanisms and sanitization. Verify revocation of leaked keys with SEC-005." } ], "completionEvidence": [ { "ja": "合成した秘密の検出テストと、成果物検査の対象範囲・結果を残す。", "en": "Record synthetic-secret test results and the coverage of artifact inspection." } ], "limitations": [ { "ja": "秘密ファイルの読み取りは所有者の権限に従います。外部のコピーを全て消したことは証明できません。", "en": "Secret-file access follows owner permissions. Deletion of all external copies cannot be established." } ], "incidentIds": [ "anthropic-cyber-evals-2026", "axios-npm-2026", "campfire-2026", "codecov-2021", "innovation-github-2026", "kyorin-remote-pc-2026", "okta-support-2023", "openai-huggingface-eval-2026", "ota-cultural-pc-scam-2026", "postman-shai-hulud-2025", "rust-arrayref-2026", "sakura-billing-2026", "toyota-github-2022", "trivy-supply-chain-2026", "unit42-ai-assisted-2026", "visualarts-cloud-credentials-2026" ], "references": [], "execution": "read-only-by-default", "provenance": "editorial-guidance" }, "example": { "ruleId": "SEC-004", "scenario": { "ja": "公開する成果物と、問い合わせ用に送る診断資料がある開発チーム。", "en": "A team publishes build artifacts and sends diagnostic attachments to support." }, "firstCheck": { "ja": "配布するファイルの一覧と生成経路を、実値を開かずに確認します。", "en": "Review the file inventory and generation paths without opening secret values." }, "lookAt": [ { "ja": "公開成果物・コンテナ・source mapの対象一覧。", "en": "The inventory of public artifacts, containers, and source maps." }, { "ja": "設定を埋め込む工程と除外設定。", "en": "Configuration embedding steps and exclusion rules." }, { "ja": "添付前の検査・伏せ字処理の結果。", "en": "Pre-attachment checks and redaction results." } ], "evidence": { "ja": "検査した成果物の識別子、除外の対象、検査が扱わなかったファイルを残します。", "en": "Record artifact identities, exclusion coverage, and files not examined." }, "limit": { "ja": "リポジトリに見当たらないだけでは、ビルド後や添付後にも混入がないとは言えません。", "en": "Absence in the repository does not establish absence from built or attached material." }, "sourceIds": ["ci"] } }, { "rule": { "id": "SEC-005", "version": "1.1.2", "updatedAt": "2026-10-26", "title": { "ja": "更新対象の資格情報と旧鍵の失効を照合する", "en": "Reconcile credential inventory and revocation" }, "summary": { "ja": "資格情報の漏洩・侵害・供給元事故が疑われる環境。通常点検では実値を含まない台帳と失効手順を確認します。", "en": "Suspected credential exposure, compromise, or supplier incidents. Routine checks use metadata inventories and revocation procedures." }, "category": "credentials", "surfaces": ["identity", "ci", "cloud", "data-store"], "applicability": { "ja": "資格情報の漏洩・侵害・供給元事故が疑われる環境。通常点検では実値を含まない台帳と失効手順を確認します。", "en": "Suspected credential exposure, compromise, or supplier incidents. Routine checks use metadata inventories and revocation procedures." }, "targets": [ { "ja": "鍵・トークン・サービスアカウントのメタデータ台帳", "en": "Metadata inventory of keys, tokens, service identities" }, { "ja": "旧鍵の失効結果・利用先・失効後の監査ログ", "en": "Revocation results, consumers, post-revocation audit logs" }, { "ja": "OAuthの有効期限・更新トークンの再利用・未使用連携の失効記録", "en": "OAuth expiry, refresh-token reuse, and revocation of unused integrations" } ], "checks": [ { "ja": "使用中と誤認されたものだけでなく、全対象のID・所有者・利用先・失効方法を照合する。", "en": "Reconcile all affected IDs, owners, consumers, and revocation methods, including identities believed unused." }, { "ja": "新しい鍵の発行と旧鍵の失効を分けて確認し、未知の追加アカウントや永続化も調査対象へ渡す。", "en": "Verify issuance and revocation separately; escalate unknown accounts and persistence for investigation." }, { "ja": "長期間有効な連携トークンと更新トークンを棚卸しし、有効期限・再利用制御・失効後の拒否をメタデータと承認済みの試験証拠で確認する。", "en": "Inventory long-lived integration and refresh tokens; verify expiry, reuse controls, and rejection after revocation through metadata and authorized test evidence." } ], "remediation": [ { "ja": "利用先への切替と旧鍵の失効を段階的に行う計画を作る。本番の失効・権限変更は既存の承認範囲で実施する。", "en": "Prepare staged consumer migration and revocation; production revocation and permission changes require existing authority." } ], "completionEvidence": [ { "ja": "台帳の全対象に失効結果が対応し、旧鍵が拒否される検証または供給元の失効記録を残す。", "en": "Record revocation for every affected identity and rejection tests or provider revocation evidence." } ], "limitations": [ { "ja": "新しい鍵を作っただけでは完了ではありません。漏洩した鍵をAIへ渡さず、権限不足なら未確認とします。", "en": "Issuing a new key alone is not completion. Never provide leaked keys to an AI; missing access means unverified." } ], "incidentIds": [ "2rinkan-api-2026", "anthropic-claude-code-abuse-2025", "anthropic-cyber-evals-2026", "applynow-bi-2026", "arcadia-raiden-2026", "askul-2025", "awabank-test-environment-2026", "axios-npm-2026", "campfire-2026", "charm-2026", "chubu-business-credentials-2026", "circleci-2023", "cloudflare-thanksgiving-2023", "cmic-ra-connect-2026", "codecov-2021", "commune-2026", "coop-yamaguchi-2026", "corona-cloud-2026", "denmark-cpr-2026", "digital-agency-gss-2026", "en-midcareer-credential-stuffing-2026", "estore-shopserve-2026", "expo-subcontractor-mail-2026", "fancrew-credential-stuffing-2026", "forticloud-sso-2026", "france-refrigeration-2026", "fuso-cloud-storage-2026", "gainsight-oauth-2025", "gmo-infoq-2026", "gyazo-2026", "hiho-mypage-2026", "ichimasa-mail-2026", "ieej-mail-2026", "inkrevolution-payment-2025", "innovation-github-2026", "jogmec-directory-2026", "jst-mail-2026", "k9natural-2026", "kddi-isp-2026", "kindal-phishing-2026", "kodansha-phishing-2026", "leanbody-metabase-2026", "legoland-amadeus-2026", "media4u-account-list-2026", "mediaplex-2026", "metabase-2026", "mitsui-fudosan-directory-2026", "murauchi-2026", "nice-mail-2026", "nikkei-m365-2026", "nikkei-workspace-2026", "nishiyama-2026", "okta-support-2023", "openai-huggingface-eval-2026", "openai-mixpanel-2025", "osaka-recruitment-vendor-2026", "pickleballone-plugin-2026", "postman-shai-hulud-2025", "prontest-cloud-2026", "quick-2025", "rakuten-drive-2026", "react2shell-2025", "rust-arrayref-2026", "ryomo-systems-2026", "sakura-billing-2026", "sakura-hosting-2026", "scala-iask-2026", "shueisha-hapicomi-2026", "skyticket-server-2026", "temairazu-2026", "times-car-2026", "tokyometro-metpo-mail-2026", "toyobo-email-2026", "toyota-github-2022", "trivy-supply-chain-2026", "trunk-mail-2026", "unit42-ai-assisted-2026", "visualarts-cloud-credentials-2026", "voising-bi-2026", "white-essence-2026" ], "references": [], "execution": "read-only-by-default", "provenance": "editorial-guidance" }, "example": { "ruleId": "SEC-005", "scenario": { "ja": "鍵を交換した記録はあるが、旧鍵の停止と利用先の更新が別々に管理されている環境。", "en": "Replacement issuance, consumer updates, and old-key invalidation are tracked separately." }, "firstCheck": { "ja": "値を含まない資格情報台帳と、対応履歴の対象IDを照合します。", "en": "Compare non-secret credential inventory identifiers with the response history." }, "lookAt": [ { "ja": "資格情報の識別子・用途・管理者。", "en": "Credential identifiers, purposes, and owners." }, { "ja": "利用するサービスと環境の対応表。", "en": "The mapping from credentials to consuming services and environments." }, { "ja": "更新と旧鍵の失効を分けた履歴。", "en": "Separate records for replacement and old-key invalidation." } ], "evidence": { "ja": "何を交換し、何を失効させ、どの利用先を確認したかを記録します。", "en": "Record what was replaced, what was invalidated, and which consumers were checked." }, "limit": { "ja": "一部の接続成功を、旧鍵が使えない証拠にしません。稼働中の鍵の変更は別の承認が必要です。", "en": "A successful connection is not proof that the old key is rejected. Changes to active credentials require separate authorization." }, "sourceIds": ["secrets"] } } ], "referenceIncidents": [ { "id": "toyota-github-2022", "title": { "ja": "トヨタ：公開ソースコードにアクセスキーが残存", "en": "Toyota: access key in a public repository" }, "organization": "Toyota / Toyota Connected", "summary": { "ja": "T-Connectのソースコードの一部がGitHubで公開され、データサーバーのアクセスキーも含まれていました。漏洩の可能性が公表されましたが、第三者のアクセスは確認されていません。", "en": "Public T-Connect source code contained a data-server access key. Toyota disclosed potential exposure; third-party access was not confirmed." }, "occurredAt": null, "disclosedAt": "2022-10-07", "reviewedAt": "2026-10-02", "outcome": "exposure-only", "categories": ["credentials", "configuration"], "cves": [], "claims": [ { "topic": "exposure", "text": { "ja": "2017年12月から2022年9月15日まで、アクセスキーを含むコードが公開されていました。", "en": "Code containing an access key was public from December 2017 to September 15, 2022." }, "status": "confirmed", "sourceIds": ["s1"], "locator": "経緯と対応" }, { "topic": "impact", "text": { "ja": "約29.6万件のメールアドレス等の漏洩可能性があり、第三者のアクセスは確認も完全な否定もできないと公表しました。", "en": "Potential exposure covered about 296,000 records; Toyota could neither confirm nor fully rule out third-party access." }, "status": "confirmed", "sourceIds": ["s1"], "locator": "本文" } ], "timeline": [ { "date": "2022-09-15", "text": { "ja": "公開を確認し、コードを非公開化。", "en": "Exposure identified and repository made private." }, "sourceIds": ["s1"] }, { "date": "2022-09-17", "text": { "ja": "アクセスキーを変更。", "en": "Access key changed." }, "sourceIds": ["s1"] }, { "date": "2022-10-07", "text": { "ja": "漏洩の可能性を公表。", "en": "Potential exposure disclosed." }, "sourceIds": ["s1"] } ], "reportedActions": [ { "topic": "response", "text": { "ja": "コードの非公開化とアクセスキーの変更を実施しました。", "en": "The source was made private and the access key changed." }, "status": "confirmed", "sourceIds": ["s1"], "locator": "経緯と対応" } ], "prevention": { "classification": "operational-control", "assessment": { "ja": "リポジトリの公開設定と秘密情報の混入を別々に点検します。公開を止めても、既に取得された鍵は失効が必要です。", "en": "Inspect repository visibility and secret inclusion separately. Closing exposure does not revoke credentials already obtained." }, "sourceIds": ["s1"] }, "ai": { "status": "unknown", "assessment": { "ja": "参照した一次情報に、攻撃でAIを利用したことを裏付ける記述はありません。AI不使用を意味しません。", "en": "The cited primary sources do not establish AI involvement. This does not establish that AI was absent." } }, "unknowns": [ { "ja": "実際の不正アクセスや個人情報の取得は、参照した発表では確認されていません。", "en": "Unauthorized access or actual data theft is not confirmed in the cited disclosure." } ], "sources": [ { "id": "s1", "title": "お客様のメールアドレス等の漏洩可能性に関するお詫びとお知らせ", "url": "https://global.toyota/jp/newsroom/corporate/38095972.html", "publisher": "トヨタ自動車", "kind": "organization", "publishedAt": "2022-10-07", "reviewedAt": "2026-10-02" } ], "ruleIds": ["SEC-004", "SEC-005"] }, { "id": "cloudflare-thanksgiving-2023", "title": { "ja": "Cloudflare：失効漏れのトークンとアカウントから侵入", "en": "Cloudflare: credentials missed during rotation" }, "organization": "Cloudflare", "summary": { "ja": "以前のOkta事故で漏洩した資格情報のうち、更新されなかったトークンとアカウントが悪用されました。自己管理のAtlassian環境に侵入され、ソースコード等にアクセスされました。", "en": "Credentials stolen in the earlier Okta incident were missed during rotation. They enabled access to self-hosted Atlassian systems and source code." }, "occurredAt": "2023-11-14", "disclosedAt": "2024-02-01", "reviewedAt": "2026-10-02", "outcome": "confirmed-breach", "categories": ["credentials"], "cves": [], "claims": [ { "topic": "entry", "text": { "ja": "未使用と誤認したサービス用トークン1つとアカウント3つが、更新されずに残っていました。", "en": "One service token and three accounts were not rotated because they were mistakenly thought unused." }, "status": "confirmed", "sourceIds": ["s1"], "locator": "Credentials not rotated" }, { "topic": "scope", "text": { "ja": "侵入は自己管理のAtlassian環境に及びました。顧客データやグローバルネットワークへの影響はなかったと公表しました。", "en": "The self-hosted Atlassian environment was accessed; Cloudflare reported no impact on customer data or its global network." }, "status": "confirmed", "sourceIds": ["s1"], "locator": "Executive summary" } ], "timeline": [ { "date": "2023-11-14", "text": { "ja": "公表された偵察・アクセスの開始。", "en": "Beginning of disclosed reconnaissance and access." }, "sourceIds": ["s1"] }, { "date": "2023-11-23", "text": { "ja": "侵入を検知。", "en": "Intrusion detected." }, "sourceIds": ["s1"] }, { "date": "2023-11-24", "text": { "ja": "攻撃者のアクセスを停止。", "en": "Attacker access terminated." }, "sourceIds": ["s1"] }, { "date": "2024-02-01", "text": { "ja": "調査結果を公表。", "en": "Investigation published." }, "sourceIds": ["s1"] } ], "reportedActions": [ { "topic": "response", "text": { "ja": "資格情報の広範な更新と、侵入範囲の調査を実施しました。", "en": "Credentials were rotated broadly and access scope investigated." }, "status": "confirmed", "sourceIds": ["s1"], "locator": "Remediation" } ], "prevention": { "classification": "operational-control", "assessment": { "ja": "更新した鍵の一覧だけでなく、対象の全資格情報と旧鍵の失効証拠を照合する点検が必要です。", "en": "Reconcile all affected credentials against rotation records and evidence that old credentials are revoked." }, "sourceIds": ["s1"] }, "ai": { "status": "unknown", "assessment": { "ja": "参照した一次情報に、攻撃でAIを利用したことを裏付ける記述はありません。AI不使用を意味しません。", "en": "The cited primary sources do not establish AI involvement. This does not establish that AI was absent." } }, "unknowns": [ { "ja": "対象資格情報の実値や内部の完全な権限構成は、公表資料から確認できません。", "en": "Public sources do not expose credential values or the complete internal authorization model." } ], "sources": [ { "id": "s1", "title": "Thanksgiving 2023 security incident", "url": "https://blog.cloudflare.com/thanksgiving-2023-security-incident/", "publisher": "Cloudflare", "kind": "organization", "publishedAt": "2024-02-01", "reviewedAt": "2026-10-02" } ], "ruleIds": ["SEC-005", "SEC-008", "SEC-009"] } ], "terms": [ { "id": "secret", "name": { "ja": "秘密情報", "en": "Secret" }, "meaning": { "ja": "APIキーや認証用トークンなど、持つことで操作や接続ができる値。点検記録には実値を残しません。", "en": "A value granting access, such as an API key or authentication token. Review records should identify it without containing the value." }, "question": { "ja": "値を開かずに、用途・対象・管理者を特定できますか。", "en": "Can you identify its purpose, target, and owner without opening its value?" }, "ruleId": "SEC-004", "sourceId": "secrets" }, { "id": "revocation", "name": { "ja": "失効", "en": "Revocation" }, "meaning": { "ja": "以前の鍵やログイン状態を、受け付ける側で使えなくすること。新しい鍵の発行と分けて確認します。", "en": "Making an old credential or session unusable at the accepting system. Verify this separately from issuing a replacement." }, "question": { "ja": "交換した後、古いものを受け付けない証拠はありますか。", "en": "What evidence shows that the old credential is rejected after replacement?" }, "ruleId": "SEC-005", "sourceId": "secrets" }, { "id": "asset", "name": { "ja": "守る対象", "en": "Asset" }, "meaning": { "ja": "サービス、保存先、管理アカウントなど、点検の対象になるもの。持ち主と用途を一緒に記録します。", "en": "A service, store, or administrative identity included in the review. Record its owner and purpose as well as its name." }, "question": { "ja": "どの環境の、誰が管理する対象を見ていますか。", "en": "Which environment and owner does this asset belong to?" }, "ruleId": "SEC-006", "sourceId": "attack-surface" } ], "sources": [ { "id": "secrets", "title": "Secrets Management Cheat Sheet", "publisher": "OWASP", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html", "locator": "2.7 Secret Lifecycle; 2.7.3 Revocation", "reviewedAt": "2026-11-12" }, { "id": "ci", "title": "CI/CD Security Cheat Sheet", "publisher": "OWASP", "url": "https://cheatsheetseries.owasp.org/cheatsheets/CI_CD_Security_Cheat_Sheet.html", "locator": "Pipeline and Execution Environment; Least Privilege; Managing Third-Party Code", "reviewedAt": "2026-11-12" } ] }