4 ms·

If you commit your AWS secrets/tokens, or similar, inside a python script it will now be discovered by github automatically. They have integrations with a bunc

If you commit your AWS secrets/tokens, or similar, inside a python script it will now be discovered by github automatically. They have integrations with a bunch of services to recognize the tokens, and disable them. This means malicious users can't copy/paste them, spin up servers and leave you with a big bill. (Ideally, of course it could still happen, but the aim is to prevent that kind of thing.)

JosephRedfern 6y ago
Though this has been true for a while, it's not what this announcement is about. This is specifically announcing automated scanning and reporting of PyPI keys, which if exposed, could allow a bad actor to distribute compromised Python packages via PyPi (e.g. pip)
- russfink 6y ago
  And this is a potentially huge security issue. Think about all the systems software that relies on Python packages.