Hex API Credential Security
- Initiative
- Back to Initiative
- Area
- Supply Chain
- Status
- In Progress (90%)
- Supporters
-
- Herrmann Ultraschall
- Funding
- Funding Complete
Goals
Provide Mechanisms to Secure API Credentials
Impact
By implementing workload identity (trusted publishing) for GitHub and GitLab, as well as introducing clearly prefixed API tokens that can be recognized by popular secret scanning tools, this milestone fortifies the integrity of package publication workflows on Hex.pm. These enhancements ensure that credentials remain secure, are readily detectable if accidentally exposed, and adhere to best practices outlined in the Principles for Package Repository Security. This tighter control and streamlined oversight of authorization mechanisms reduces the risk of compromised accounts and unauthorized access.
Deliverables
- Implement Workload Identity (Trusted Publishing)
- GitHub
- GitLab
- API Tokens are prefixed and the prefix is registered with common secret scanners such as GitHub
Notes
This milestone received considerable external open source contributions, in particular for the GitHub workload identity implementation.
Relevant Standards
- Principles for Package Repository Security
- Authorization / Level 1, 3