3 ms·
You pushed your secret key, and they recognised it? Does that imply that they are not hashing secret keys, or did you also push the account key (allowing for a
by stephenr 10y ago
You pushed your secret key, and they recognised it?
Does that imply that they are not hashing secret keys, or did you also push the account key (allowing for a single auth test on their side)?
- hughes 10y agoThe secret key can probably be used to generate the account key.
- pyre 10y agoIt's also possible that they just scrape the Github firehose for common patterns like AWS_SECRET_KEY="FOOBAR" and send a message to the committer's email (since you presumably used a correct/valid email in the git commit).