Principle of Least Privilege

In accordance with the principle of least privilege, organizations should minimize the permissions granted to any individual or entity whenever feasible, with the aim of reducing the potential attack surface in the event of a security breach. These findings can identify potentially hazardous tokens, identities, or policies.

ACL Permissions over secret

Excessive unused token permissions

External accounts can read your secrets