5 ms·
A Github PAT being exposed to Github is not the problem. That is, in fact, intended behaviour. A Github PAT being exposed to the internet is something else enti
by glitchc 3y ago
A Github PAT being exposed to Github is not the problem. That is, in fact, intended behaviour. A Github PAT being exposed to the internet is something else entirely, and likely to be an accident in most cases. That's what thd protection's for.
- darthbanane 3y agoFor PAT ok but surely this also scans for aws credentials etc, or is it really just about PATs?
- bmitc 3y agoWhat's worse: them being scanned and prevented or being committed into the public repository without anyone's knowledge?
- darthbanane 3y agoYeah I'm not saying this is not a net positive. I just don't understand why the recommendation reads like all is good as long as one amends the commit and nothing just happened.
- bmitc 3y agoThat makes sense. I think it's just an extra step of protection, kind of like an alert that someone may have seen your ATM pin, so it's probably best to rotate it. But, your pin wasn't posted on the Internet.