4 ms·
I have an idea: What if companies using secret keys (not SaaS providers who generate secret keys) voluntarily send their secret keys (MD5 hashed or somehow enc
by paradite 4y ago
I have an idea:
What if companies using secret keys (not SaaS providers who generate secret keys) voluntarily send their secret keys (MD5 hashed or somehow encrypted) to GitHub and GitHub can then monitor their leakage and notify the company?
Is this useful or feasible?
- devcat 4y agoGithub already has system to invalidate tokens without storing any hashes themselves https://docs.github.com/en/code-security/secret-scanning/secret-scanning-patterns https://docs.github.com/en/code-security/secret-scanning/sec...
- paradite 4y agoYes. This is dependent on some kind of agreement or understanding between SaaS provider and GitHub. I'm thinking of a generic approach which is independent of where you got the secret key and its format.
- devcat 4y agoSame system can be applied for repo owner being pattern provider and getting notified with matches but if i had to guess only enterprise customers might get feature like this