4 ms·
Like .* ?
by iampivot 4y ago
Like .* ?
- tonmoy 4y agoI don’t think GitHub will send back the matching string, just the name of the repos
- maria2 4y agoThat seems bad? Look for /winnie/i in all private repos. The repo name includes the owner. Then go and arrest them.
- deleted 4y ago[deleted]
- jasode 4y ago>Like .* ? Assuming your question is not a joke... The partner has to email the regex to secret-scanning@github.com for their approval. See the steps at: https://docs.github.com/en/developers/overview/secret-scanning-partner-program#identify-your-secrets-and-create-regular-expressions https://docs.github.com/en/developers/overview/secret-scanni... Once it's in the scanning system, the partner receives JSON messages alerts such as: [ { "token":"NMIfyYncKcRALEXAMPLE", "type":"mycompany_api_token", "url":"https://github.com/octocat/Hello-World/blob/12345600b9cbe38a219f39a9941c9319b600c002/foo/bar.txt", "source":"content" } ] So instead of ""token":"NMIfyYncKcRALEXAMPLE"," -- the private repo owners would worry about '.*' regex leaking full source code instead of API credentials such as ""token":"#include <stdio.h>\nmain(){\nprintf("hello world");\n}"," The above scenario requires believing the following: - Microsoft/Github is technically incompetent and an employee and/or their internal regex sanity checking tool will blindly accept open-ended regex like '.*' - MS/Github will then allow that unbounded regex to leak petabytes of private source code out to China partners via the JSON "token:" response. (Github says they have 18+ petabytes of data and most of that is private repos: https://twitter.com/github/status/1569852682239623173 https://twitter.com/github/status/1569852682239623173) If one believes their entire private repo source code is at risk of being copied to TenCent being leaked by the '.*' threat because the above scenario seems realistic, I assume the answer is to delete the repo.
- oefrha 4y agohttps://docs.github.com/en/code-security/secret-scanning/about-secret-scanning https://docs.github.com/en/code-security/secret-scanning/abo... is pretty damn clear that secret scanning for private repos only alert owners; only the public repo scans alert partners (for instant revocation).