4 ms·
You might have strings that match one of their secrets regex's that are not an actual secret. It would be extremely annoying if they blocked you from pushing a
by psanford 5y ago
You might have strings that match one of their secrets regex's that are not an actual secret. It would be extremely annoying if they blocked you from pushing a commit in that case.
- Aissen 5y agoBut they have the secrets, can't they check that it's the actual secret ?
- atatatat 5y agoFrom the security side, thaaat sounds like a can of worms.
- psanford 5y agoGithub doesn't check if the secrets are real or not. Any string that matches one of the regexs gets shared with the appropriate API provider. The provider checks to see if the its a valid credential or not and revokes the key if necessary.