3 ms·
How is Open AI API key the second biggest secret in repo already. Others like AWS and Google Cloud have been around and popular for decades! Also why no Azure
by albert_e 3y ago
How is Open AI API key the second biggest secret in repo already. Others like AWS and Google Cloud have been around and popular for decades!
Also why no Azure alongside AWS and Google?
- orf 3y agoI can’t remember how I set this up right now, but I think it’s unique keys. And someone did manage to accidentally publish a master list of 500 individual keys at one point, which definitely boots the numbers. This analysis will be re-done with some other data soon.
- amethyst 3y agoGithub has automation to detect and mitigate repos with AWS/GCC API keys. They probably don't (yet?) have equivalents for OpenAI or other similar services that aren't as popular.
- judge2020 3y agoGH has the Secret Scanning Partner Program https://docs.github.com/en/code-security/secret-scanning/secret-scanning-partner-program https://docs.github.com/en/code-security/secret-scanning/sec... OpenAI is one of the supported platforms - A list of providers is at https://docs.github.com/en/code-security/secret-scanning/secret-scanning-patterns#supported-secrets https://docs.github.com/en/code-security/secret-scanning/sec...
- progmetaldev 3y agoAzure secrets works differently, and stores the keys outside of your project directory (traditionally). I'm sure someone could find a way to include them (and probably include multiple projects rather than a single project), but they would have to go out of their way to do this.
- deleted 3y ago[deleted]