Show HN: GitMonKey – monitor your repos and commits for exposed private keys
1–10 of 50 posts
Re: Show HN: GitMonKey – monitor your repos and commits for exposed private keys
#2It seems this should be a standard product offering for GitHub
Re: Show HN: GitMonKey – monitor your repos and commits for exposed private keys
#3It seems this should be a standard product offering for GitHub
Agreed. Or software you can just run internally. Not a fan of just opening up read access to my code to a new startup.
Re: Show HN: GitMonKey – monitor your repos and commits for exposed private keys
#4It seems this should be a standard product offering for GitHub
Github does this actually but only from github access tokens generated from their API... if you generate an oauth access token and commit it, they will automatically revoke it.
Re: Show HN: GitMonKey – monitor your repos and commits for exposed private keys
#5It seems this should be a standard product offering for GitHub
Agreed. Or software you can just run internally. Not a fan of just opening up read access to my code to a new startup.
There are git hooks that u can run locally, but think as a manager of an R&D team of 10-20 developers. You need to make it centralised.
Re: Show HN: GitMonKey – monitor your repos and commits for exposed private keys
#6It seems this should be a standard product offering for GitHub
Agreed. Or software you can just run internally. Not a fan of just opening up read access to my code to a new startup.
Yeah, what if gitmonkey accidentally reveal a secret key? Now somebody has a curated list of everyone's git's secret keys - even the ones in private repos!
Re: Show HN: GitMonKey – monitor your repos and commits for exposed private keys
#7How about this one? https://github.com/dxa4481/truffleHog
Posted here a few months ago.
Re: Show HN: GitMonKey – monitor your repos and commits for exposed private keys
#8To see it with JS disabled, disable also CSS.
Re: Show HN: GitMonKey – monitor your repos and commits for exposed private keys
#9Weirdly AWS and GitHub seems to have something similar. I know a couple of folks (not me!) who've uploaded AWS credentials to OSS projects on GitHub and been contacted by AWS about it, after AWS has revoked the credentials.
Re: Show HN: GitMonKey – monitor your repos and commits for exposed private keys
#10Weirdly AWS and GitHub seems to have something similar. I know a couple of folks (not me!) who've uploaded AWS credentials to OSS projects on GitHub and been contacted by AWS about it, after AWS has revoked the credentials.
I wonder if they scan GH periodically, or simply see abnormal action on these accounts that are accessed by the exposed keys.