6 ms·
What absolute incompetence. Not just on this dev, but any org with API keys ought to be scanning for leaked keys constantly. Failure of one and failure of many.
by Cheer2171 1y ago
What absolute incompetence. Not just on this dev, but any org with API keys ought to be scanning for leaked keys constantly. Failure of one and failure of many.
Of course Elon hires only based on 'merit'...
- Everdred2dx 1y agoHow would you scan for your api keys on repos outside of your organization? I assumed this was a dev’s personal repo.
- kalkin 1y agohttps://docs.github.com/en/code-security/secret-scanning/secret-scanning-partnership-program/secret-scanning-partner-program https://docs.github.com/en/code-security/secret-scanning/sec... is one option
- Everdred2dx 1y agoNeat. Thanks!
- squigz 1y agoWell 1 option is the service from TFA. https://www.gitguardian.com/monitor-internal-repositories-for-secrets https://www.gitguardian.com/monitor-internal-repositories-fo...
- romellem 1y agoThe company I work for does this. I recently pushed an update to a personal repo that just contained a keyword match (the push included a dictionary.txt file which happened to include the company name) which flagged a review.
- mcdwayne 1y agoThis was on public GitHub, which anyone can scan for anything. Their API is a firehose you can consume: https://api.github.com/events https://api.github.com/events GitGuardian's public report on secrets sprawl talks about their methodology of scanning any commit https://www.gitguardian.com/state-of-secrets-sprawl-report-2025 https://www.gitguardian.com/state-of-secrets-sprawl-report-2...