Toyota Accidently Exposed a Secret Key Publicly on GitHub for Five Years

Re:Toyota Accidently Exposed a Secret Key Publicly on GitHub... by echelon on Friday October 14, 2022 @12:51AM (#33199759)

The whole industry should adopt a convention to prefix production keys with a well known prefix, such as "prod_secret_".

We should have our systems and precommit hooks then alert us when those enter places they shouldn't and help us automate rotation.

[ Parent | on HN ]

Re:Toyota Accidently Exposed a Secret Key Publicly on GitHub... by jve on Friday October 14, 2022 @04:40AM (#33201084)

Bad idea. Better do it in DEV like you would do in PROD, not to shoot yourself in the foot. If you do it right in DEV, no problem in PROD.

And what if your DEV is not actually well isolated from PROD/other infra? And what if some real data sneaked into DEV? Etc.

[ Parent | on HN ]

Re:Toyota Accidently Exposed a Secret Key Publicly on GitHub... by mewpmewp2 on Friday October 14, 2022 @06:00AM (#33201536)

I think prod_ might not be the important part there, so something like __secret__ should be enough.

[ Parent | on HN ]

Re:Toyota Accidently Exposed a Secret Key Publicly on GitHub... by MattJ100 on Friday October 14, 2022 @06:03AM (#33201546)

You're not the first with this idea! There exists a standard, see RFC 8959: https://www.rfc-editor.org/rfc/rfc8959.html

[ Parent | on HN ]