Asana

Scan Asana projects and tasks for exposed secrets

The Asana Integration in the Praetorian Guard Platform (PGP)

The Asana integration in PGP provides continuous scanning of your organization's Asana workspace to detect exposed secrets such as API keys, tokens, passwords, and other sensitive information. PGP connects to Asana using a personal access token, discovers the projects in your workspace, and scans each project's tasks — including task names, descriptions, and comments — for security risks. On subsequent scans, PGP performs incremental checks — only re-scanning content that has changed since the last run.

Prerequisites

Before you begin, ensure you have:

  • An Asana account with access to the target workspace and projects
  • Access to your PGP account

Creating a Personal Access Token in Asana

  1. Sign in to Asana and open the developer console
  2. Under Personal access tokens, click Create new token
  3. Give the token a descriptive name (e.g., "PGP Integration") and click Create token
  4. Copy the token immediately — it will not be shown again

Note: The token inherits the permissions of the account that created it. Use an account with read access to every project you want scanned.

Configuring the Integration in PGP

  1. In PGP, navigate to the Integrations page
  2. Find and click on Asana under the "SaaS Security" section
  3. Provide the following details:
    • Workspace — Your Asana workspace GID or name
    • Personal Access Token — The token you created
  4. Click Connect to establish the integration

Once configured, PGP will discover the projects in your workspace and scan their tasks for exposed secrets.

Verifying the Connection

To verify that your connection is working:

  1. Navigate to Assets in PGP
  2. Look for asana:project assets — each discovered project appears as an asset named after the project
  3. Check the Integrations page to confirm the Asana connection status

Note: PGP enumerates tasks by project. A task that is not attached to any project is not discovered, and therefore is not scanned.

Remediating Exposed Secrets

To fully eliminate an exposure surfaced in Asana:

  1. Remove the secret from the task name, description, or comment where it appears
  2. Rotate the affected credential to invalidate any copies that may have already been captured

Because comments and task activity can be seen by anyone with access to the project, treat any surfaced secret as compromised until it has been rotated.

Troubleshooting

Common issues and solutions:

  • Unable to Connect — Verify the personal access token is valid and has not been revoked
  • Authentication Errors — Confirm the account that created the token still has access to the workspace
  • Workspace Not Found — Ensure the Workspace value matches a workspace GID or name the token can access
  • No Projects Discovered — Confirm the account has read access to the target projects

If you continue to experience issues, contact PGP Support.

Managing Your Connection

To manage your Asana connection:

  1. In PGP, navigate to the Integrations page
  2. Find your Asana connection
  3. Use the options menu (⋮) to update the stored credential (Refresh Token) or remove the connection (Disconnect)

Additional Resources

Need help? Contact our support team for assistance.