---
title: "WEB-APP-004 Rails Master Key or Secrets File Exposed"
canonical: https://openvapt.com/checks/WEB-APP-004.html
html: https://openvapt.com/checks/WEB-APP-004.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# WEB-APP-004 Rails Master Key or Secrets File Exposed

Checks Rails config/master.key, credentials key files and secrets.yml for world-read permissions or a location inside a web root.

- Domain: Web Apps
- Severity: High
- Control category: Access Control
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N`
- CIS Controls v8: 3.3
- NIST CSF 2.0: PR.AA-05, PR.DS-01
- CWE: CWE-732, CWE-312, CWE-321
- OWASP Top 10 2021: A02:2021, A05:2021
- OWASP ASVS 4.0.3: 2.10.4, 14.1.3
- OWASP WSTG v4.2: WSTG-CONF-09
- NIST SP 800-53 Rev. 5: AC-3, SC-28, IA-5

## Why It Matters

master.key decrypts credentials.yml.enc, which holds every production secret, and secrets.yml holds the secret_key_base that signs sessions. Anyone who reads them can forge sessions and read the database password. Both are meant to stay out of version control and out of any public folder.

## How It Detects

Finds config/master.key, config/credentials/*.key and config/secrets.yml in the project folders and fails when the file is readable by others or sits inside a web document root. Contents are never read.

## How to Fix

chmod 600 config/master.key config/credentials/*.key; keep them out of git (.gitignore) and out of public/; load the key from RAILS_MASTER_KEY in the environment on servers. Rotate the credentials if the key was ever exposed.

## How to Verify

```
stat -c '%a %n' config/master.key  shows 600, and git ls-files config/master.key  prints nothing.
```

## Learn the Theory

- [A6 Application Framework and CMS Configuration](https://openvapt.com/academy/a6.md)

## References

- [Ruby on Rails Guides, Securing Rails Applications](https://guides.rubyonrails.org/security.html)
- [Ruby on Rails Guides, Custom Credentials](https://guides.rubyonrails.org/security.html#custom-credentials)
- [OWASP Secrets Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/frameworks.go

Run it: `openvapt scan --only WEB-APP-004`. Read it offline: `openvapt explain WEB-APP-004`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/WEB-APP-004.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.