1. I have accidently pushed discord api keys to github like a dozen times, and every time, I immediately get an email for discord saying " hey idiot, you goofed. Go get new keys".

  2. We are moving to dev ops and we have a lot of staff new to version control. I have to constantly rotate passwords right now.

  3. Precommit hooks are your friend. Does your commit contain a high entropy string? Block the commit from being pushed. Doesn't catch them all, but it might catch a few.

  4. Not only that, quiet a few api tokens has a unique structure that can easily be regexed after instead

  5. I worked in a startup that got interviewed by a national TV, when there was a coworker with the key on screen and if you screenshot it you can zoom into it and read the key lol.

  6. When it's happened to me, it's always in low-stakes situations for personal projects, where it's not awesome if someone else gets my key, but nothing awful is going to happen.

  7. Happened last year on my team. Dev was working on a test and used the credentials to verify the test was working as expected, but they had commit the changes. Pre-commit hooks didn't catch it.

  8. You can, but it's futile: you cannot guarantee your git history is not replicated somewhere.

  9. Jajajajaja this is my very big fear to me~ I wish never live this 😅😅😅 only think in billing for prototypes scare me...

  10. Did they report the leak to the owners of those accounts? I kind of read the article, but didn't see anything about notifying them.

  11. Brother used a GitHub service to automatically scan the Python base periodically. When the results get added to the repository, AWS’ own security measures kick in and notify the owner of the key

  12. Maybe you should create a new post instead of replying to something completely unrelated to your question.

  13. I was going to comment about this. The credentials were found, but the credentials could be very limited. Even if public they could be harmless like you can read an S3 bucket or something.

Leave a Reply

Your email address will not be published. Required fields are marked *

News Reporter