Skip to main content

Scale API Key

Scale API Keys are used to authenticate requests to Scale's suite of services, which provide machine learning data labeling and annotation solutions. These keys grant access to Scale's APIs, allowing users to submit data for processing, retrieve results, and manage projects. Exposure of these keys is a significant security concern as it can lead to unauthorized access to sensitive data and misuse of Scale's services, potentially incurring unexpected costs and compromising data integrity.

How Does It Look​

API Keys can appear in various contexts, such as:

  • Environment variables:

    export SCALE_API_KEY="sk_live_XXXXXXXXXXXXXXXXXXXX"

  • Configuration files (JSON, YAML, .env):

    {
      "scaleApiKey": "sk_live_XXXXXXXXXXXXXXXXXXXX"
    }
    scale_api_key: sk_live_XXXXXXXXXXXXXXXXXXXX

  • Code snippets:

    scale_client = ScaleClient(api_key="sk_live_XXXXXXXXXXXXXXXXXXXX")

  • Connection strings:

    scale://sk_live_XXXXXXXXXXXXXXXXXXXX@api.scale.com

Severity​

  • 🔴 Critical

The severity is critical because the API Key provides direct access to Scale's services, potentially allowing an attacker to manipulate data, access sensitive project information, and incur financial costs by submitting large volumes of data for processing. The blast radius includes all projects and data associated with the compromised key.

What Can an Attacker Do?​

With immediate access to the Scale API, an attacker can perform several malicious actions:

An attacker can immediately access and manipulate data within Scale's services, potentially leading to data breaches and unauthorized data processing.

Key actions an attacker can perform:

  • Submit fraudulent data: An attacker can submit large volumes of data for processing (if the key has submission permissions), leading to increased costs.
  • Access sensitive project data: Retrieve project details and results (if the key has read permissions), potentially exposing confidential information.
  • Modify project configurations: Change project settings or data labeling instructions (if the key has write permissions), disrupting operations.
  • Delete projects: Remove existing projects and their data (if the key has delete permissions), causing data loss.

Additionally, an attacker could use the compromised key to escalate their access within the organization or move laterally to other systems by exploiting trust relationships or shared credentials.

Real-World Impact​

The exposure of a Scale API Key poses significant business risks, including financial, operational, and reputational damage.

Primary impacts include unauthorized access to sensitive data and potential financial losses due to misuse of Scale's services.

Potential consequences include:

  • Data Exposure: Confidential project data and results (if the credential has read access to sensitive data)
  • Financial Loss: Increased costs from unauthorized data submissions (if billing/resource creation is permitted)
  • Operational Disruption: Altered or deleted projects affecting business operations (if the attacker has delete/modify permissions)
  • Reputational Damage: Loss of client trust and brand reputation due to data breaches

In a worst-case scenario, the exposure could lead to cascading effects, such as regulatory scrutiny and loss of business opportunities.

Prerequisites for Exploitation​

To exploit a Scale API Key, an attacker needs:

  • Network access: Ability to send requests to Scale's API endpoints
  • API endpoint knowledge: Understanding of Scale's API structure and endpoints
  • No IP restrictions: Lack of IP allowlisting or network restrictions on the API Key

How to Verify If It's Active​

To verify if a Scale API Key is active, use the following command:

curl -H "Authorization: Bearer [API_KEY]" https://api.scale.com/v1/projects

Valid credential response: A successful response will return a list of projects associated with the API Key.

Invalid/expired credential response: An error message indicating unauthorized access or invalid credentials.

Detection Patterns​

Common Variable Names:

  • SCALE_API_KEY
  • scaleApiKey
  • SCALE_KEY
  • scale_key
  • API_KEY_SCALE
  • scaleApi

File Locations:

  • .env
  • config.json
  • settings.yaml
  • credentials.py
  • app.config

Regex Pattern:

sk_live_[A-Za-z0-9]{24}

Remediation Steps​

  1. Revoke immediately - Go to Scale's dashboard > API Keys and delete the compromised key.
  2. Audit access logs - Review Scale's API logs for unauthorized requests or data submissions during the exposure window.
  3. Assess blast radius - Identify all systems, applications, and environments that used the exposed credential.
  4. Rotate credential - Generate a new API Key in Scale's dashboard with least-privilege permissions.
  5. Update dependent systems - Deploy the new credential to all applications and update CI/CD pipelines securely.
  6. Harden access controls - Enable IP allowlisting in Scale's dashboard and require secure connections.
  7. Implement secrets management - Migrate credentials to a secrets manager (HashiCorp Vault, AWS Secrets Manager) to prevent hardcoding.
  8. Add detection controls - Set up pre-commit hooks and repository scanning to catch credential leaks before they reach production.

Credential exposures often go undetected for extended periods, increasing the window for exploitation. As a long-term strategy, plan to establish an internal process or engage an external vendor for continuous external exposure monitoring. This helps identify leaked secrets across public repositories, paste sites, dark web forums, and other external sources before attackers can leverage them. Proactive detection and rapid response are essential to minimizing the impact of credential leaks.

References​