Marketing Cloud Engagement - Audit Script Activities for Hardcoded Secrets with SSJS

In the business unit in which you need to audit Script Activities for hardcoded secrets, create a DE with the following specifications:

• Name: ScriptActivity_SecurityAudit

• External Key: ScriptActivity_SecurityAudit

After the DE has been created, you will need to create an SSJS activity to fetch the scripts and log the results. The script searches the code of all Script Activities for a specific string (such as "client_secret") and uses WSProxy to insert the results into the Data Extension.

NOTE: Please ensure that the subdomain, clientId, clientSecret, and mid values are supplied. This process leverages the REST API - so you will need to reference an appropriate Installed Package within your account.

<script runat="server">
Platform.Load("Core", "1.1.1");

try {
    var subdomain = "YOUR_SUBDOMAIN"; 
    var clientId = "YOUR_CLIENT_ID";
    var clientSecret = "YOUR_CLIENT_SECRET"; 
    var mid = "YOUR_MID";
    
    var searchString = "client_secret";
    var targetDEKey = "ScriptActivity_SecurityAudit"; 

    var authUrl = "https://" + subdomain + ".auth.marketingcloudapis.com/v2/token";
    var payload = {
        grant_type: "client_credentials",
        client_id: clientId,
        client_secret: clientSecret,
        account_id: mid
    };

    var authReq = new Script.Util.HttpRequest(authUrl);
    authReq.emptyContentHandling = 0;
    authReq.retries = 2;
    authReq.continueOnError = true;
    authReq.contentType = "application/json";
    authReq.method = "POST";
    authReq.postData = Stringify(payload);

    var authResp = authReq.send();
    var authJson = Platform.Function.ParseJSON(String(authResp.content));
    var token = authJson.access_token;
    var restUrl = authJson.rest_instance_url;

    if (token) {
        var scriptsUrl = restUrl + "automation/v1/scripts";
        var scriptReq = new Script.Util.HttpRequest(scriptsUrl);
        scriptReq.emptyContentHandling = 0;
        scriptReq.retries = 2;
        scriptReq.continueOnError = true;
        scriptReq.method = "GET";
        scriptReq.setHeader("Authorization", "Bearer " + token);

        var scriptResp = scriptReq.send();
        var scriptJson = Platform.Function.ParseJSON(String(scriptResp.content));
        
        var items = scriptJson.items || scriptJson; 
        
        var prox = new Script.Util.WSProxy();

        for (var i = 0; i < items.length; i++) {
            var content = items[i].script || ""; 
            
            if (content.toLowerCase().indexOf(searchString.toLowerCase()) !== -1) {
                
                var insertProps = [
                    { Name: "ScriptKey", Value: items[i].key },
                    { Name: "ScriptName", Value: items[i].name },
                    { Name: "FoundString", Value: searchString }
                ];
                
                var result = prox.createItem("DataExtensionObject", {
                    CustomerKey: targetDEKey,
                    Properties: insertProps
                });
            }
        }
    } 
} catch (error) {
    Write("Error: " + Stringify(error));
}
</script>