4 ms·

FWIW, AWS actually does this for you. Their response time is pretty amazing, too. IIRC, they caught me pushing an active key within 2-3 minutes.

• 0x0 11y ago
  That's pretty sweet, but by then the damage's already done. Rejecting the push would be even better, making sure the confidential data never goes public. AIUI dark-hatted people are scraping the real-time push feeds at Github for credentials and botting up exploits, so even a few seconds could be a big enough window for damage to be done. An example of this happening on AWS just like you mentioned: https://www.humankode.com/security/how-a-bug-in-visual-studio-2015-exposed-my-source-code-on-github-and-cost-me-6500-in-a-few-hours https://www.humankode.com/security/how-a-bug-in-visual-studi...
  • fapjacks 11y ago
    I was just thinking of this exact story when the grandparent mentioned AWS. They have a huge financial interest in automatically detecting this kind of thing.
  • thedufer 11y ago
    I mean, obviously AWS can't reject your pushes, so it's the best they can do, but I agree that it would be nice if Github did this as well. > That's pretty sweet, but by then the damage's already done. I'm not sure that's true. I was able to disable the key before anyone used it (although it was locked down so far that they couldn't have charged anything to my account, since I didn't trust the code I was testing with real money).