Skip to content

PubNub Subscription Key

Service Name: PubNub

Service Description: PubNub is a real-time communication platform that provides global messaging and data streaming infrastructure for building real-time applications. It enables developers to build and scale real-time applications for chat, IoT, location tracking, and more.

Service Address: https://www.pubnub.com/

Validation Type: API Auth

IP Allow list: IP restrictions can be configured at the account level through PubNub's Access Manager (PAM)

Secret Access Scope: Grants read access to channels and channel groups within a PubNub application. Subscription keys allow clients to subscribe to channels and receive messages published to those channels.

Secret Revokement URL: https://admin.pubnub.com/#/login

Secret Example: sub-c-1234abcd-5678-9abc-def0-123456789abc

Suspicious Activity Investigation Instructions:

  • Review PubNub analytics dashboard for unusual subscription patterns or traffic spikes
  • Check for unexpected geographic access patterns in the PubNub admin console
  • Monitor for unauthorized channel subscriptions or access attempts
  • Review application logs for unexpected subscription requests
  • Check for unusual message volume or patterns that might indicate compromise

Mitigation Instructions:

  • Log in to the PubNub Admin Portal at https://admin.pubnub.com/
  • Navigate to the Keys section for your application
  • Generate new subscription keys to replace the compromised ones
  • Update your application code with the new subscription keys
  • Consider implementing PubNub Access Manager (PAM) to restrict channel

access

  • Enable token-based authentication for more granular access control
  • Set up channel-level permissions to limit access to sensitive channels
  • Configure proper TTLs (Time To Live) for access permissions
  • Monitor the application after key rotation to ensure proper functionality