Skip to content

Netlify Token

Service Name: Netlify

Service Description: Netlify is a web development platform that offers hosting and serverless backend services for web applications and static websites. It provides continuous deployment from Git, global CDN, one-click HTTPS, and many other features.

Service Address: https://www.netlify.com/

Validation Type: API Auth

IP Allow list: IP restrictions can be configured at the team level for access to the Netlify UI and API.

Secret Access Scope: Grants programmatic access to Netlify resources including sites, domains, DNS settings, forms, and functions. Depending on the token scope, it may allow deployment, site creation, and team management.

Secret Revokement URL: https://app.netlify.com/user/applications

Secret Example: 2gEcNiNWkGQeYKSbmQnX-5t_Ax7LxBVVBWYDNAhBE5Q

Suspicious Activity Investigation Instructions:

  • Review the Netlify audit logs for unusual site deployments or configuration changes.
  • Check for unauthorized site creations or modifications.
  • Monitor for unexpected domain configurations or DNS changes.
  • Look for unusual API calls or access patterns from unfamiliar IP addresses.
  • Verify if there are any unauthorized team member additions.

Mitigation Instructions:

  • Sign in to your Netlify account at https://app.netlify.com/.
  • Go to User Settings > Applications.
  • Find the compromised personal access token in the list.
  • Select Revoke next to the token to immediately invalidate it.
  • Create a new token with appropriate scopes if needed.
  • Update any legitimate applications or CI/CD pipelines with the new token.
  • Review and update any security settings for your Netlify account, including enabling two-factor authentication.
  • Consider implementing more granular token scopes for different applications or services.