Rotate Azure Repos SSH keys and personal access tokens
The following is a best practice guideline from our series of 8 Azure Repos security best practices
8. Rotate Azure Repos SSH keys and personal access tokens
Azure Repos access is typically done using SSH keys or personal access tokens (in lieu of a password). But what happens if those tokens are stolen and you didn’t know? Be sure to refresh your keys and tokens periodically, mitigating any damage caused by keys that leaked out.
Continue reading the list of 8 Azure Repos security best practices:
- Never store credentials as code/config in Azure Repos
- Remove sensitive data in your files and Azure Repos history
- Tightly control access
- Add a SECURITY.md file
- Use Personal Access Tokens
- Provide granular permissions and groups for users
- Add security testing to Pull Requests
- Rotate SSH keys and personal access tokens
If you haven’t done so yet, make sure you download this cheat sheet now and pin it up, so your future decisions are secure decisions!