4 ms·
> Our team leaked an API key in a Git commit during maintenance and was immediately alerted by GitGuardian. To revert that change and clean up the git history,
by bsuvc 5y ago
> Our team leaked an API key in a Git commit during maintenance and was immediately alerted by GitGuardian. To revert that change and clean up the git history, Pierre decided to switch our repository from public to private until our team fixed it.
I hope they still invalidated that key and got a new one, because I don't think simply git reset and force pushing to overwrite a commit you already pushed to a public repository is sufficient to make sure someone didn't already capture it.
- saleemkce 5y ago"I hope they still invalidated that key and got a new one, because I don't think simply git reset and force pushing to overwrite a commit you already pushed to a public repository is sufficient to make sure someone didn't already capture it." -I totally agree you.
- bombcar 5y agoIn fact, you should have an "ohshit.bat" command ready to go that contacts everything and invalidates/replaces the API keys. And like your backups and your SSL certificates, you should actually run it regularly.
- errcorrectcode 5y agoInvalidating the key should've been their first move and then stopping to think their second. Rushing around without a plan invariably leads to damage and errors.