Provider
cassette (generic)
Key
csst******************************aaa
Status
valid
Generated
Account
acct_demo
Plan or tier
team

Why this severity

Capabilities

Capabilities
Service Access Detail Data Cost Restricted
Cassette Files read Can list uploaded files yes no no
Cassette Metadata read Can read project metadata no no no

Evidence

Each entry is a read-only request and the response summary that proves the access. Keys are masked.

Cassette Files — read

Can list uploaded files

GET https://api.cassette.invalid/v1/files?key=<key> -> 200, 2 files

Cassette Metadata — read

Can read project metadata

GET https://api.cassette.invalid/v1/metadata?key=<key> -> 200, project metadata returned

Remediation

  1. Revoke or rotate this key now. It was found outside the systems that should hold it, so treat it as known to others.
  2. Remove the key from wherever it leaked — including git history, build logs and image layers, not only the current file.
  3. Check the provider's audit or usage logs for calls made with this key, especially from addresses or times you do not recognise.
  4. Scope the replacement: least-privilege permissions, plus referrer, IP or app restrictions where the provider supports them.
  5. Store the replacement in a secret manager and re-scan the repository before the next deployment.