[---

My Mailgun Domain Sending Key leaked! What should I do?

What is a Mailgun Domain Sending Key and how it is used?

A Mailgun Domain Sending Key is a unique identifier that allows you to securely send emails through the Mailgun email service on behalf of a specific domain, ensuring secure and authenticated email delivery.

When using Mailgun, the Domain Sending Key is primarily used for:

Authenticating and securing email communications: The Domain Sending Key is used to authenticate and secure email communications sent through Mailgun. It ensures that only authorized senders can send emails on behalf of a specific domain, helping to prevent spoofing and unauthorized access.
Ensuring deliverability and reputation: By using the Domain Sending Key, developers can improve email deliverability rates and maintain a positive sender reputation. This key helps Mailgun's systems verify the authenticity of the sender, which can positively impact email deliverability and inbox placement.
Managing and tracking email performance: The Domain Sending Key allows developers to track and manage the performance of emails sent through Mailgun. By associating each email with a specific key, developers can monitor delivery rates, open rates, and other metrics to optimize their email campaigns.

---]

[---

1. Code snippets to prevent Mailgun Domain Sending Key hardcoding using environment variables

Using environment variables for storing sensitive information like Mailgun Domain Sending Key in your code is a secure practice because:

Environment variables are not hard-coded in the codebase, reducing the risk of exposure.
They can be easily managed and updated without altering the code.
Environment variables are typically stored in a secure location on the server, adding an extra layer of protection.
They are not visible in the code repository, minimizing the chance of accidental leakage.

How to secure your secrets using environment variables

---]

[---

2. Code snippet to prevent Mailgun Domain Sending Key hardcoding using AWS Secrets Manager

Using AWS Secrets Manager to manage Mailgun Domain Sending Keys is a secure way to handle sensitive data. Here are code snippets in five different programming languages that demonstrate how to retrieve the Mailgun Domain Sending Key from AWS Secrets Manager.

---]

[---

3. Code snippet to prevent Mailgun Domain Sending Key hardcoding using HashiCorp Vault

Using HashiCorp Vault for managing Mailgun Domain Sending Keys is a great way to enhance security. Here are code snippets in five different programming languages for securely handling a Mailgun Domain Sending Key using HashiCorp Vault.

Remember to replace the VAULT_ADDR and VAULT_TOKEN with your Vault server address and authentication token. The snippets assume that the Mailgun Domain Sending Key is stored under the api_key field within Vault. The specifics of the Vault path and field names should be adjusted to match your Vault setup.

---]

[---

4. Code snippet to prevent Mailgun Domain Sending Key hardcoding using CyberArk Conjur

Using CyberArk Conjur to manage Mailgun Domain Sending Key is a secure way to handle sensitive data. Here are code snippets in five different programming languages that demonstrate how to retrieve the Mailgun Domain Sending Key from CyberArk Conjur.

---]

[---

How to generate a Mailgun Domain Sending Key?

To generate a Mailgun Domain Sending Key, follow these steps:

Log in to your Mailgun account.
Go to the "Domains" section in the dashboard.
Select the domain for which you want to generate the sending key.
Click on the "Domain Settings" tab.
Scroll down to the "Domain Sending Keys" section.
Click on the "Add New Sending Key" button.
Enter a description for the sending key (optional).
Click on the "Create" button to generate the sending key.

Once the sending key is generated, you can use it in your email sending scripts or applications to authenticate and send emails through Mailgun on behalf of the selected domain.

---]

[---

My Mailgun Domain Sending Key leaked, what are the possible reasons?

There are several reasons why a Mailgun Domain Sending Key might have been leaked:

Weak or compromised user credentials used to access the Mailgun account.
Improper storage of the Domain Sending Key in code repositories or configuration files that are publicly accessible.
Insufficient access controls within the organization, allowing unauthorized individuals to access the key.
Phishing attacks targeting employees with access to the key, leading to its disclosure.
Malware or spyware on developer machines or servers that capture the key during development or deployment processes.

What are the risks of leaking a Mailgun Domain Sending Key

When it comes to the Mailgun Domain Sending Key, it is crucial for developers to understand the risks associated with leaking this sensitive information. Below are some of the key risks that developers need to be aware of:

Unauthorized Access: If the Mailgun Domain Sending Key is leaked, it can be used by unauthorized individuals to send emails on behalf of your domain. This can lead to phishing attacks, spamming, and other malicious activities.
Data Breach: Leaking the Mailgun Domain Sending Key can result in a data breach, where sensitive information contained in the emails sent through Mailgun can be exposed to unauthorized parties.
Reputation Damage: Misuse of the Mailgun Domain Sending Key can damage the reputation of your organization, as recipients may receive unsolicited or malicious emails that appear to be sent from your domain.
Financial Loss: In addition to reputation damage, a breach of the Mailgun Domain Sending Key can also result in financial loss, as your organization may incur costs related to mitigating the impact of the breach and potential legal consequences.

It is essential for developers to implement robust security measures to protect the Mailgun Domain Sending Key and ensure that it is not leaked or misused. This includes following best practices for secret management, such as storing the key securely, restricting access to authorized personnel only, and regularly monitoring for any unauthorized usage.

---]

[---

Mailgun Domain Sending Key security best practices

Avoid embedding the secret directly in your code. Instead, use environment variables or secrets managers‍
Secure storage: store the Mailgun Domain Sending Key in a secure location, such as a password manager or a secrets management service.
Regular rotation: periodically rotate the API key to minimize the risk of long-term exposure.
Restrict permissions: apply the principle of least privilege by only granting the key the minimum necessary permissions.
Monitor usage: regularly check the usage logs for any unusual activity or unauthorized access attempts.
Implement access controls: limit the number of users who have access to the secret and enforce strong authentication measures.
Use a secrets manager: utilize secret management tools like CyberArk or AWS Secrets Manager for enhanced security.

By adhering to the best practices, you can significantly reduce the risk associated with Mailgun Domain Sending Key usage and improve the overall security of your Mailgun Domain Sending Key implementations.

Exposing secrets on GitHub: What to do after leaking Credential and API keys

---]

[---

Mailgun Domain Sending Key leak remediation: what to do

What to do if you expose a secret: How to stay calm and respond to an incident [cheat sheet included]

How to check if Mailgun Domain Sending Key was used by malicious actors

Review Access Logs: Check the access logs of your Mailgun Domain Sending Key account for any unauthorized access or unusual activity. Pay particular attention to access from unfamiliar IP addresses (if you haven’t set up a specific allow list) or at odd hours.
Monitor Usage Patterns: Look for anomalies in the usage patterns, such as unexpected spikes in data access or transfer.
Check Active Connections and Operations: Review the list of active connections and recent operations on your database. Unusual or unauthorized operations might indicate malicious use.
Audit API Usage: If possible, audit the usage of your API key through any logging or monitoring services you have integrated with Mailgun Domain Sending Key. This can give insights into any unauthorized use of your key.

---]

[---

Steps to revoke the Mailgun Domain Sending Key

Generate a new Mailgun Domain Sending Key:

Log into your Mailgun Domain Sending Key account.
Navigate to the API section and generate a new API key.

Update Services with the new key:

Replace the compromised key with the new key in all your services that use this API key.
Ensure all your applications and services are updated with the new key before deactivating the old one.

Deactivate the old Mailgun Domain Sending Key:

Once the new key is in place and everything is functioning correctly, deactivate the old API key.
This can typically be done from the same section where you generated the new key.

Monitor after key rotation:

After deactivating the old key, monitor your systems closely to ensure that all services are running smoothly and that there are no unauthorized access attempts.

---]

[---

How to understand which services will stop working

Inventory of services: keep an inventory of all services and applications that utilize your Mailgun Domain Sending Key.
Communication and documentation: Ensure that your team is aware of which services are dependent on the key. Maintain documentation for quick reference.
Testing: before deactivating the old key, test your services with the new key in a staging environment. This helps in identifying any services that might face issues post rotation.
Fallback strategies: Have a fallback or emergency plan in case a critical service fails after the key rotation. This might include temporary measures or quick rollback procedures.

In summary, the remediation process involves identifying potential misuse, carefully rotating the key, and ensuring minimal disruption to services. Being proactive and having a well-documented process can greatly reduce the risks associated with a compromised API key.

---]

[---

What about other secrets?

GitGuardian helps developers keep 350+ types of secrets out of source code. GitGuardian’s automated secrets detection and remediation solution secure every step of the development lifecycle, from code to cloud:

On developer workstations with git hooks (pre-commit and pre-push);
On code sharing platforms like GitHub, GitLab, and Bitbucket;
In CI environments (Circle CI, Travis CI, Jenkins CI, GitHub Actions, and many more);
In Docker images.

---]

payment_intent

nullable object

The PaymentIntent object for errors returned on a request involving a PaymentIntent.

Hide

Show

child attributes

CLIENT LIBRARIES

$ gem install stripe

STRIPE-RUBY

$ pip install stripe

STRIPE-PYTHON

$ composer require stripe/stripe-php

STRIPE-PHP

MAVEN
<dependency>
  <groupId>com.stripe</groupId>
  <artifactId>stripe-java</artifactId>
  <version>24.16.0</version>
</dependency>

GRADLE
compile "com.stripe:stripe-java:24.16.0"

STRIPE-NODE

$ npm install --save stripe

STRIPE-NODE

$ go get github.com/stripe/stripe-go/v76

STRIPE-NODE

$ nuget install Stripe.net

STRIPE-NODE

SHOW

This is placeholder code

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents

Table of Contents