5 ms·

Please don't check your keys or passwords into github. This was my first search to show AWS API Keys. [1] and my second to show google API keys. [2] Unfortunat

• capableweb 4y ago
  As far as I can tell, all the git repos come from GitHub, and GitHub automatically sends you a warning if you commit access keys of various kinds (and I seem to remember they even de-activate some, maybe AWS keys, automatically? Not 100% sure about this). Most of the keys shown are unlikely to be working, especially the ones older than just a couple of days (either owner notice, or someone else was faster than you, got access and regenerated new keys for themselves)
  • IncRnd 4y ago
    > or someone else was faster than you, got access and regenerated new keys for themselves There are many people who do these types of searches - regularly. If there is any key material checked into gh, consider it immediately compromised, even if the repo is removed.
    • capableweb 4y ago
      Tons of automated scraping for these sort of things as well, with the whole flow of "check if key is working, check permissions, if authorized, generate new key and deactivate old one".
      • IncRnd 4y ago
        Yes. There are indeed several mitigations in place. However, my point was that within 5 seconds of looking at this tool I was able to uncover hundreds of potential issues. There are many other regexs I have on my list. Please don't fall into the trap of "we have anti-virus, so we can't get attacked."
        • capableweb 4y ago
          Sorry if I was unclear, my previous comment was about attackers doing that in order to compromise infrastructure, not that companies are doing it in order to defend themselves. But companies probably do it to defend themselves as well, but I'm not as familiar with that as with the other side of things.
  • greysteil 4y ago
    GitHub PM here, just confirming that that's correct (re: us sending detected secrets to the relevant service provider, who take action automatically). There's more detail here: https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning#about-secret-scanning-alerts-for-partners https://docs.github.com/en/code-security/secret-scanning/abo....
    • iambateman 4y ago
      This is probably one of the single most important security measures on the whole internet. Thanks for keeping an eye out.
• abraham 4y ago
  Most of the Google API keys look like they are client side keys and should be configured to only work on specific origins or apps.
• TYMorningCoffee 4y ago
  Your search has a lot of false positives like AKIAIOSFODNN7EXAMPLE
• madeofpalk 4y ago
  Most of these actually look like fake keys to mock data in unit tests.
• teaearlgraycold 4y ago
  Hacker noises - "I'm in"
• kristopolous 4y ago
  ----- BEGIN RSA NOT SO PRIVATE KEY -----
• arp242 4y ago
  Many of these are tests, false positives (e.g. base64 images or "Migration1599570560FixSlovakiaDisplayedAsSloveniaTest"), or examples from documentation. Can't find a single match for an actual API key.
  • codalan 4y ago
    These are probably invalid by now. https://grep.app/search?current=2&q=api_key%20%3D%20%22%5Ba-zA-Z0-9%5D%2B%22&regexp=true https://grep.app/search?current=2&q=api_key%20%3D%20%22%5Ba-... As others have posted, Github implemented an alerting system for keys/passwords/etc. that have been checked into the codebase. My guess is most of these will be invalidated by now, either by the developer requesting a new key (and not publishing it), or the provider invalidating it for them.
• zikohh 4y ago
  https://sourcegraph.com/search?q=context:global+AKIA%5B0-9A-Z%5D%7B16%7D&patternType=regexp&sm=1&groupBy=repo https://sourcegraph.com/search?q=context:global+AKIA%5B0-9A-... Sourcegraph is much better than this site.