3 ms·
Pretty sure GitHub runs a system that will automatically revoke every (AWS and other) key to ever become part of a repository.
by stefan_ 4y ago
Pretty sure GitHub runs a system that will automatically revoke every (AWS and other) key to ever become part of a repository.
- whoknew1122 4y agoNot in my experience dealing with customers who had AWS email them saying 'Hey, we found one of your keys on GitHub'.
- philsnow 4y agoI’ve worked on a team where Github was the one who reached out about a leaked AWS secret key, not AWS. They apparently usually do this a few minutes before the key makes it into their search index. It’s not much but it’s better than nothing.
- OJFord 4y agoThat evidently didn't happen here. I do remember reading about that too though, maybe it missed it because it was JSON data not a variable definition or something? https://docs.github.com/en/code-security/secret-scanning/secret-scanning-patterns#supported-secrets-for-partner-patterns https://docs.github.com/en/code-security/secret-scanning/sec... I can't find anywhere that specifies the actual pattern though.
- zhfliz 4y agoit wasn't stored on GitHub. there's a json file on GitHub referencing the download of the source archive, stored on pypi infra. in the tgz you can download from pypi you can find python code containing the secret. https://github.com/orf/pypi-data/blob/main/release_data/i/h/ihip.json https://github.com/orf/pypi-data/blob/main/release_data/i/h/...
- rodgerd 4y agoThey have the tools to do that. You might be horrified by how many shitty developers want all the good guardrails GHE provides switched off, and how many managers will support them because they're a "superstar who gets things done".
- xdfgh1112 4y agoNot automatically since that would lead to them getting sued, no?