segudev
Re:1 in 10 developers leaked an API-key in 2022
on Monday May 29, 2023 @05:31AM (#36112256)
If the numbers look suspicious to you, I would suggest you check what is found more specifically about your company/organization.
GitGuardian can provide an automatic audit of your company-specific leaks we found on GitHub. Just ask: https://www.gitguardian.com/complimentary-audit-secrets-leak...
More details on how it works: https://blog.gitguardian.com/github-secrets-leak-free-audit/
Show HN: We've built SaaS-Sentinel, the Downdetector for supply chain breaches
https://blog.gitguardian.com/how-we-built-a-supply-chain-security-watchtower-meet-saas-sentinel/
Honeytoken technology is becoming more and more important in the world of supply chain security. SaaS-Sentinel is an alerting platform based on this technology to notify subscribers when a honeytoken planted in a SaaS provider was triggered. This is the story of the project.
Show HN: Honeytoken – give attackers a taste of their own medicine
GitHub Exposed a Private SSH Key: What You Need to Know
10M Secrets Discovered in GitHub in 2023, Exposed by 1.35M Authors (1 in 10)
Top Practices for Secure Software Development
Code Confessions: Share Your Hardcoded Secret Horror Stories
Re:Show HN: Infisical – open-source secrets manager
on Tuesday December 20, 2022 @04:01AM (#34063407)
I'm afraid I have to disagree. There are so many different needs it is impossible to discredit them so simply.
I recommend that readers take inspiration from this model of maturity to see more clearly: https://www.gitguardian.com/files/secrets-management-maturit...
Secrets Horror Stories
Secrets Management Maturity Model
SOPS: A Comprehensive Guide
10 Rules for Better Cloud Security
Re:Billion-record stolen Chinese database for sale on breach forum
on Wednesday July 06, 2022 @11:40AM (#32002572)
Unfortunately, it's not as simple as that.
Lots of secrets are "generic" (think of a DB user/password combination), meaning that you need to take into account the surrounding source code context to be able to determine if they are a "real" secret.
Here is a full explanation if you are interested: https://blog.gitguardian.com/why-detecting-generic-credentia...
Re:Billion-record stolen Chinese database for sale on breach forum
on Wednesday July 06, 2022 @11:33AM (#32002475)
Indeed, last year we detected on average 84 AWS IAM creds for every 10k commits pushed to GitHub
https://res.cloudinary.com/da8kiytlc/image/upload/v164614852...