What will happen when you commit secrets to a public Git repo?

Re:What will happen when you commit secrets to a public Git ... by jefftk on Saturday November 07, 2020 @10:41AM (#25015669)

I think secret detection is great overall, but the only times I've run into it are false positives with client side API keys that are by their nature public.

For example, I recently configured something to use the Google calendar API from JavaScript on the client. It's fully safe to check in this key, since it is intended to be run in client-side JavaScript anyway, but I was still nagged about it.

[ Parent | on HN ]

Re:What will happen when you commit secrets to a public Git ... by mackenzie-gg on Monday November 09, 2020 @06:00AM (#25033485)

It's a difficult challenge. Secrets detection is probabilistic, without checking the credentials it's nearly impossible to determine, with 100% accuracy, a true vs a false positive. But it has made big improvements. What detection solutions have you been using?

[ Parent | on HN ]

Re:What will happen when you commit secrets to a public Git ... by jefftk on Monday November 09, 2020 @07:32AM (#25034068)

I get automated emails that I didn't sign up for from GitGuardian:

"GitGuardian has detected the following Google Key exposed within your GitHub account."

My understanding was that they could use an API to check whether it was a real key, but perhaps that doesn't say whether it is a client-side or server-side key?

[ Parent | on HN ]