Setting the file. One moment.
Skill 18 · Mapbox Token Security
Subchapter 18.1
references/incident-response.mdMarkdown2 KBView on GitHub
Immediate actions (first 15 minutes):
Investigation (within 24 hours): 5. Review access logs to understand exposure 6. Check for unauthorized usage in Mapbox dashboard 7. Identify root cause (how was it exposed?) 8. Document incident with timeline and impact
Prevention (within 1 week): 9. Update procedures to prevent recurrence 10. Implement additional safeguards (CI checks, secret scanning) 11. Train team on lessons learned 12. Update documentation with new security measures
❌ CRITICAL ERROR:
// NEVER DO THIS - Secret token in client code
const map = new mapboxgl.Map({
accessToken: 'sk.YOUR_SECRET_TOKEN_HERE' // SECRET TOKEN
});✅ Correct:
// Public token only in client code
const map = new mapboxgl.Map({
accessToken: 'pk.YOUR_PUBLIC_TOKEN_HERE' // PUBLIC TOKEN
});❌ Too broad:
{
"scopes": ["styles:*", "tokens:*"]
}✅ Specific:
{
"scopes": ["styles:read"]
}❌ No restrictions:
{
"scopes": ["styles:read"],
"allowedUrls": [] // Token works anywhere
}✅ Domain restricted:
{
"scopes": ["styles:read"],
"allowedUrls": ["https://myapp.com/*"]
}❌ Never rotated:
Token created: Jan 2020
Last rotation: Never
Still in production: Yes✅ Regular rotation:
Token created: Dec 2024
Last rotation: Dec 2024
Next rotation: Mar 2025❌ Committed to Git:
// config.js (committed to repo)
export const MAPBOX_TOKEN = 'sk.YOUR_SECRET_TOKEN_HERE';✅ Environment variables:
// config.js
export const MAPBOX_TOKEN = process.env.MAPBOX_SECRET_TOKEN;# .env (in .gitignore)
MAPBOX_SECRET_TOKEN=sk.YOUR_SECRET_TOKEN_HERE