Re:GitHub commit search: “remove password”
by obsurveyor on Wednesday February 15, 2017 @09:37AM
(#13652253)
You can scrape the issues without exposing the token. You could probably do it by just subscribing to all of them and parsing emails. No one(especially in security) should be using a third party search to match sensitive data. It's like searching Google for your social security number.
Re:GitHub commit search: “remove password”
by lutefisk on Wednesday February 15, 2017 @09:37AM
(#13652250)
It was a pattern based script, all the tokens had the same length.
If the token is XYZ and the script is searching https://github.com/search?utf8=%E2%9C%93&q=XYZ&type=Commits&...:
1. It's sharing the token with GitHub.
2. It's embedding the token as query-string parameter in a GET request, which is much more likely to be logged (than sending it as data in a POST request), and more likely to be available to less-privileged/less-trusted staff.
3. If the request is sent to a non-HTTPS endpoint, the query can be MITMd, revealing the token.
I'd be very wary of setting up a token-finding script, it feels like it adds more risk than it saves.