4 ms·
You're definitely on to something. I know (personal) Github API tokens use a prefix of ghp_ and the Github-app JWT-issued tokens have another prefix (maybe gha
by FrenchyJiby 4y ago
You're definitely on to something.
I know (personal) Github API tokens use a prefix of ghp_ and the Github-app JWT-issued tokens have another prefix (maybe gha_? Can't remember)
As mentioned recently here on HN, a generalized version of this technique is what RFC8959[1] proposes via "secret-token" prefix.
Do add these to all your pre-commit hooks and other password detectors/log analysers!
[1]: https://www.rfc-editor.org/rfc/rfc8959.html https://www.rfc-editor.org/rfc/rfc8959.html