Characterizing secret leakage in public GitHub repositories

Re:Characterizing secret leakage in public GitHub repositories by aflag on Monday April 08, 2019 @03:03PM (#19608082)

Shouldn't GitHub put in some sort of warning for potential leaks when they happen?

[ Parent | on HN ]

Re:Characterizing secret leakage in public GitHub repositories by gcommer on Monday April 08, 2019 @03:06PM (#19608111)

From the paper: "GitHub recently introduced a beta version of Token Scanning"

https://help.github.com/en/articles/about-token-scanning

https://github.blog/2018-10-17-behind-the-scenes-of-github-t...

[ Parent | on HN ]

Re:Characterizing secret leakage in public GitHub repositories by aflag on Monday April 08, 2019 @03:42PM (#19608379)

That's ok, I guess. But I was thinking more in the lines of blocking the push unless you disabled the feature from your repo.

[ Parent | on HN ]

Re:Characterizing secret leakage in public GitHub repositories by Pawamoy on Monday April 08, 2019 @04:43PM (#19608823)

I once pushed a GitHub token in a public repository. They immediately revoked the token and notified me by email.

[ Parent | on HN ]

Re:Characterizing secret leakage in public GitHub repositories by LyndsySimon on Monday April 08, 2019 @03:07PM (#19608116)

I believe they have it - I've gotten notified in the past when I committed secrets on purpose, for test applications. I'm not 100% sure they were from GitHub, but I think they were.

[ Parent | on HN ]