Toyota Accidently Exposed a Secret Key Publicly on GitHub for Five Years

Re:Toyota Accidently Exposed a Secret Key Publicly on GitHub... by Kiro on Thursday October 13, 2022 @06:32PM (#33197344)

Question: Let's say I want to open source my app but a long time ago I used to have credentials hard coded. What can I do to clean this up from history?

[ Parent | on HN ]

Re:Toyota Accidently Exposed a Secret Key Publicly on GitHub... by tyler569 on Thursday October 13, 2022 @06:39PM (#33197396)

Git does have tools that allow you to rewrite history to fix situations like this, but by far the easiest solution is to invalidate those credentials so they become worthless.

[ Parent | on HN ]

Re:Toyota Accidently Exposed a Secret Key Publicly on GitHub... by scarmig on Thursday October 13, 2022 @06:36PM (#33197371)

https://docs.github.com/en/authentication/keeping-your-accou...

[ Parent | on HN ]

Re:Toyota Accidently Exposed a Secret Key Publicly on GitHub... by lalopalota on Thursday October 13, 2022 @11:50PM (#33199442)

make a new repo starting with the code in its current state.

[ Parent | on HN ]

Re:Toyota Accidently Exposed a Secret Key Publicly on GitHub... by lumberjack24 on Friday October 14, 2022 @05:02AM (#33201237)

Here's a checklist [1] (again, from gitguardian) of steps to follow before open-sourcing projects and [2] a guide on how to remediate hardcoded/exposed secrets.

[1] https://blog.gitguardian.com/safely-open-source-software-bes... [2] https://blog.gitguardian.com/leaking-secrets-on-github-what-...

[ Parent | on HN ]