3 ms·

Thanks for sharing. Did you also investigate what they actually did with the keys?

• 0xad 6y ago
  You mean adversaries? No. For token generation I used https://canarytokens.org/ https://canarytokens.org/ so the only information I got was abou triggering the token, but not the context in which it was triggered. BTW. GitHub (apart from GitGuardian) also has Secret Scanning feature [1] that basically allows the provider to act on the leaked secret. Amazon is integrated and it should invalidate and inform the owner but this also went to Thinkst, not me, so I don't know if it was actually invalidated and alerted. [1] https://developer.github.com/partnerships/secret-scanning/ https://developer.github.com/partnerships/secret-scanning/