Greetings fellow Hackers! OP here. I see that my experiment got some traction which means more awareness should be spread about this class of bugs. For starter

Greetings fellow Hackers! OP here. I see that my experiment got some traction which means more awareness should be spread about this class of bugs. For starters I recommend reading "How Bad Can It Git" [1] and "Detecting and Mitigating Secret-Key Leaks inSource Code Repositories" [2] papers. After that you can read "How I made $10K in bug bounties from GitHub secret leaks" [3] and some notable reports on HackerOne Hacktivity [4] [5] and [6]. This last one is interesting - leaking secrets is not only about code repository! Actually it's about entire toolset used for software development, hence secret scanning could (should?) be performed for other places such as CICD logs or even Slack messages [7]. Anyhow, back to code repositories. GitHub and GitLab both recognized secrets as a problem, so they came up with solutions. If you use GitHub you can easily integrate GitGuardian [8] into your workflow ($$$) but even if you don't GitHub provides you with Secret Scanning feature [9] (both are mentioned within the Twitter and HN threads). If you use GitLab you have a Secret Detection feature [10] at your disposal BUT in order to use it you need to setup Auto DevOps (that's why in my experiment GitLab didn't alert me - I just pushed commits to my public repo but didn't setup anything). Apart from built-in solutions provided by GitHub and GitLab, one can use tooling of their own choice. For this I'd recommend two types of solutions: proactive and reactive. For proactive security, as mentioned in the Twitter thread, you can use Talisman [11] as pre-commit hook. For reactive security you can use GitLeaks [12] (used by GitLab) or similar tools - there are many of them but one stands out, namely truffleHog [13] which can sniff each and every commit across all branches (also used by GitLab). What if you already commited a secret into the public repository? Start with revoking and continue with this tutorial [14] gl, hf. [1] https://www.ndss-symposium.org/ndss-paper/how-bad-can-it-git-characterizing-secret-leakage-in-public-github-repositories/ https://www.ndss-symposium.org/ndss-paper/how-bad-can-it-git... [2] https://people.eecs.berkeley.edu/~rohanpadhye/files/key_leaks-msr15.pdf https://people.eecs.berkeley.edu/~rohanpadhye/files/key_leak... [3] https://tillsongalloway.com/finding-sensitive-information-on-github/index.html https://tillsongalloway.com/finding-sensitive-information-on... [4] https://hackerone.com/reports/716292 https://hackerone.com/reports/716292 [5] https://hackerone.com/reports/396467 https://hackerone.com/reports/396467 [6] https://hackerone.com/reports/496937 https://hackerone.com/reports/496937 [7] https://github.com/PaperMtn/slack-watchman https://github.com/PaperMtn/slack-watchman [8] https://www.gitguardian.com/ https://www.gitguardian.com/ [9] https://developer.github.com/partnerships/secret-scanning/ https://developer.github.com/partnerships/secret-scanning/ [10] https://docs.gitlab.com/ee/user/application_security/sast/#secret-detection https://docs.gitlab.com/ee/user/application_security/sast/#s... [11] https://github.com/thoughtworks/talisman https://github.com/thoughtworks/talisman [12] https://github.com/zricethezav/gitleaks https://github.com/zricethezav/gitleaks [13] https://github.com/dxa4481/truffleHog https://github.com/dxa4481/truffleHog [14] https://docs.github.com/en/free-pro-team@latest/github/authenticating-to-github/removing-sensitive-data-from-a-repository https://docs.github.com/en/free-pro-team@latest/github/authe...