---
title: "Data Leaks"
canonical: "https://kb.cynergy.app/space/GS/899416810/Data%20Leaks"
format: markdown
---
The Data Leak Scan is a Machine Learning based scan that identifies information about different types of Data Leaks from various sources*:

- API Keys
- Sensitive paths such as administrative login paths or default documentation paths
- Credentials Disclosure Check - Sensitive information in source code such as credentials, email, and usernames
- Hardcoded Credentials - Credentials identified in the code or reference in the code for the credentials
- Sensitive information in files in multiple paths such as configuration files, Database backups
- Leaks in public GutHub and Pastebin Repositories
- Microsoft Azure Domain ID - an informational finding about the TenantID

![image](media://fc35c36a-6520-4b10-98e9-70860ba5ebbb)

**Based on the different types of findings, here are the general mitigation options:**

1. **Leaked API keys:**
  1. Verify how the application is utilizing the API key and it is safe to expose the API key.
  2. If the API key shouldn’t be exposed then delete the API key entry from the source code or relevant Javascript.
2. **Credentials Disclosure Check:**
  1. Verify if the credentials can be used in the system
  2. If the credentials can be used, delete the entry
  3. If it is related to a GitHub that is not controlled by the organization, report to Cynergy to assist with takedowns, or consult your legal and request takedown.
3. **Hardcoded Credentials:**
  1. Verify the validity of the leak
  2. Given the fact that the Hardoced Credentials are sensitive information, remove the entry from the file or delete the file.
4. **Sensitive information in files:**
  1. Verify if the credentials can be used in the system
  2. If the information is sensitive and shouldn’t be disclosed publicly delete the entry or the relevant file.
  3. If it is related to a GitHub that is not controlled by the organization, consult with your legal and request takedown.
5. **Leaks in public GutHub and Pastebin Repositories:**
  1. Validate the information identified.
  2. If the credentials can be used, delete the entry
  3. If it is related to a GitHub that is not controlled by the organization, consult with your legal and request takedown.
6. **Microsoft Azure Domain ID**
  1. An informational finding doesn’t require a fix
  2. If it is related to a GitHub that is not controlled by the organization, report to Cynergy to assist with takedowns, or consult your legal and request takedown.

> ℹ️ The “Data Leak” scan is still in active development, and may provide false positive findings. 
> ℹ️ 
> ℹ️ In addition, there are known cases where:
> ℹ️ 
> ℹ️ - EPSS scoring and finding severity is not correctly adjusted
> ℹ️ - Findings are duplicated (many times)
> ℹ️ - The findings are based on some naming conventions and may provide irrelevant information