Open cardosec

Case A1F954 · Cloud · L2 Practitioner

Storage Token Shared on GitHub

Practise as: Incident drill · InterviewLevel: L2 Practitioner

Live alertA researcher reports that a public GitHub repository of yours links to "sample data" with an Azure SAS token. The token is an account SAS with read, write and delete on the whole storage account, and it expires in 2051.

Interview questionA long-lived storage token with full access was published on GitHub. How do you respond?

  1. 01 What happened?
  2. 02 What is the impact?
  3. 03 What do you do?
Practise this card As Interview
What a strong answer covers

Try it out loud first. Then check yourself:

  1. Revoke it: an account SAS is signed with the account key, so rotate that key, which invalidates every token it signed.
  2. Scope: storage logs (if enabled) show what was read, written or deleted, and from where; check for planted files.
  3. Assess the data: the whole account was reachable, not just the sample folder; involve privacy and legal if needed.
  4. Prevent: user delegation SAS with short expiry, policies limiting SAS lifetime, secret scanning on repos, and storage logging.

If the interviewer pushes back

  • This is close to a 2023 incident at a large company. What made that leak so large, and what would have limited it?

Go deeper

More Cloud cards

All Cloud cards →

cardosec draws a security topic and gives you a clock: explain it out loud with no notes, then see what you covered and what you missed. Free during early access.

Reviewed 2026-10-09