7 ms·
There are multiple bots that crawl github for pubkeys and other credentials.
by jldugger 8y ago
There are multiple bots that crawl github for pubkeys and other credentials.
- bcaa7f3a8bbc 8y agoI know blackhats and grayhats must have been doing it for years. But I'm not aware there's any bot that acts in a whitehat manner to disclose it to affected parties and conduct public researches, is there? I mean, something like those RSA keys crawling projects by cryptographers that have discovered several types of non-random keys with zero security.
- jldugger 8y agoI admit I've been on the receiving side of some notices about low value API keys. https://www.gitguardian.com https://www.gitguardian.com for example, uses this sort of thing as a public service / sales lead I guess.
- bcaa7f3a8bbc 8y agoGood to know, thanks for the info.
- detaro 8y agoGithub does it themselves: https://github.blog/2018-10-17-behind-the-scenes-of-github-token-scanning/ https://github.blog/2018-10-17-behind-the-scenes-of-github-t...