Vault Radar FAQ

This FAQ contains frequently asked questions about HCP Vault Radar.

Q: Why does Vault Radar use HMAC + Argon?

Argon2id is a strong and secure hashing algorithm providing memory-hardness, parallelism-safety, and adjustable parameters. It has undergone years of cryptographic testing and analysis, and is resistant to brute-force attacks due to the increased compute cost to crack.

To increase security, Vault Radar also uses “peppering” on top of Argon2id hash.

Q: If both the database and the HMAC key are leaked, someone could launch a brute-force attack on the database?

One of Argon2id's main features is resistance against brute force attacks. It is very expensive in both memory and CPU to attempt these types of attacks.

Q: How do we calculate severity?

The severity can be overridden by event rules for specific patterns, but this applies only to HCP scans and not CLI offline scans.

Severity	Definitions
Critical	The risk category is secret, secret is active and secret is in the latest version of a data source. The risk category is secret, secret is active and secret is in the latest version of a secret manager.
High	This risk category is secret, secret is active and secret is not in the latest version of a data source. The risk category is secret, secret is in the latest version of a secret manager and its activeness cannot be determined.
Medium	If none of the other conditions are met, the severity is set to medium by default.
Low	The risk category is PII. The risk has certain tags (e.g., `secret_in_test_file`, `secret_in_example_file`).
Info	The risk category is NIL. The risk has certain tags (e.g., `ignore_rule`, `google_maps_api_key`, `inactive_secret`). The risk type is AwsAccessKeyId and is not active.

Q: What are the rules to assign secret_in_test_file tag?

the file or (sub)directory name of the file where the risk is located contains "test".
the (sub)directory name of the file where the risk is located starts with "mocks".
the (sub)directory name of the file where the risk is located is "qa".

Q: What are the explicit exclusions made by Radar Secret Engine?

Keys and IDs containing EXAMPLE or TEST are not reported at all.
README files are marked as not important.
Test files are marked as not important.

Q: What IPs should be allowlisted for Vault Radar SaaS to scan data sources inside a user's network directly from HCP?

Users will need to allow inbound access from the following IP addresses in order for Vault Radar HCP to communicate with data sources within a secure network.

# Vault Radar Primary
3.213.172.245
44.215.93.123
34.226.175.235

# Vault Radar Failover
34.208.33.38
44.227.97.170
44.238.204.12

Note

There may be changes to these IP’s in the future, HashiCorp (Vault-Radar) will do its best to give customers a reasonable amount of time to make the necessary changes.

Q: What firewall allowlisting is required for Vault Radar CLI and Agent to authenticate with HCP?

If outbound traffic is restricted from within a user's network, then following fully qualified domain names (FQDNs) should be allowed in order for the Vault Radar Agent and/or CLI to communicate with HCP.

api.cloud.hashicorp.com
auth.idp.hashicorp.com

Note

HashiCorp HCP does not have a predefined set of static IP’s for ingress traffic to its servers at this time.

Q: What secret hasher key is the offline Vault Radar CLI using?

Because the CLI is offline it cannot contact HCP to retrieve the project's secret hasher key. The CLI sets and creates it's own key to be reused in subsequent scans for consistency. The configuration is saved at: $HOME/.vault-radar.json with key "secret_hasher_key". Example:


{"secret_hasher_key":"LaTuHNZD/QFXGjuKcKYthNUGp6zwrqy/86R824tyfRU"}

Q: Does Vault Radar detect Base64 encoded secrets?

Yes. Vault Radar detects Base64 encoded secrets in two ways:

Dedicated Base64 secret types: Many providers have a matching secret type with a _BASE64 suffix, such as AWS_ACCESS_KEY_ID_BASE64 and GITHUB_TOKEN_BASE64. Vault Radar reports these findings under the _BASE64 type. Refer to the secret types documentation for the full list.
Automatic decoding of generic secrets: When Vault Radar detects a generic secret, it decodes the value if that value is valid standard or URL-safe Base64. If the decoded value matches a known provider pattern, Vault Radar reports the finding under that specific secret type instead of the generic type.

In both cases, Vault Radar treats the Base64 encoded value like any other secret. It masks the value in the UI and stores only a hash of the encoded value as it appears in your source. Vault Radar never stores or displays the decoded value.