Developers are pretty bad about this sort of thing. Back when this article was written, GitHub didn’t have its automatic scanning and you could just search “sit

Developers are pretty bad about this sort of thing. Back when this article was written, GitHub didn’t have its automatic scanning and you could just search “site:github.com intext:sk_live_” to find hundreds of Stripe live secret keys that would give you full access to someone’s hard earned cash. Surprised this article doesn’t mention it but a scary amount of desktop apps use Electron nowadays which has considerably fewer protections than Chrome (and usually what protections it has are turned off by lazy devs). Since it runs at an OS level with very little safeguard there’s a lot of damage you could do, for example electron.shell can be turned into an easy RAT.