4 ms·
According to the documentation (https://docs.github.com/en/developers/overview/secret-scanning https://docs.github.com/en/developers/overview/secret-scanni...),
by nindalf 6y ago
According to the documentation (https://docs.github.com/en/developers/overview/secret-scanning https://docs.github.com/en/developers/overview/secret-scanni...), secret issuers specify a regex that can detect secrets they've issued. "Be as precise as possible, because this will reduce the number of false positives" - that's the guideline from GitHub. Github runs the regex on every commit that is uploaded and informs the secret provider when a match occurs.
- kevincox 6y agoI wonder if false-positives often result in GitHub sending secrets to the wrong service.
- danudey 6y agoI wonder if any of those services have a combination of bad regexes and bad validation and could be SQL injected by committing a malicious faux-token to GitHub.
- remram 6y agoI see that they document the alerting endpoint there. The only piece missing is building the URL from the token format. I hope we get there someday, and everyone can deploy this without having to replicate GitHub's registry of token formats. This page also mentions that they "strongly recommend you implement signature validation in your secret alert service", but I'm not sure why. Isn't the fact that they send valid tokens proof that they have really found a leak?
- dragonwriter 6y agoSo, you can submit an overly generous (or specifically crafted) regex to get notified of tokens that someone else issued if you know their format?