GitLeaks – Search engine for exposed secrets on GitHub
1–10 of 63 posts
Re: GitLeaks – Search engine for exposed secrets on GitHub
#2Didn't take long from the proggit/HN 'removed password' post to gitleaks:
$ whois gitleaks.com | grep Creation
Creation Date: 06-feb-2017
Re: GitLeaks – Search engine for exposed secrets on GitHub
#3Are there any legal ramifications for operating something like this?
I know it's publicly available info but since the original creator of the information didn't directly give it to you, do you still have the usual immunity given to service providers?
Also, just because something is on $PUBLIC_URL doesn't mean the copyright would allow you redistribute it. I'm sure a lot of these projects have either a private license, or more likely, no license at all.
Re: GitLeaks – Search engine for exposed secrets on GitHub
#4I guess that's one way to get attention to your business.
Instead of informing the owners of repositories by creating an issue, you create a search engine to expose them, and then ask to be paid for usage of this index? The only reason someone would want those secrets is to abuse them. This is basically the only use case for the data. Why do this?
This is coming from "fallible.co" whose homepage says "Prevented 40 million+ users personal data leaks". So you are in the business of making sure people's information does not get leaked, and at the same time expose people's secrets?
Re: GitLeaks – Search engine for exposed secrets on GitHub
#5Why not use your knowledge of these exposed secrets for good? You know which repo they're coming from, it'd be super simple to let the owner know rather than potentially costing them time and money.
It also seems as though the only use of this site is to capitalise on other people's mistakes? It looks like you're just handing over leaked data to people who will definitely abuse it, which seems to go against your core business of preventing data leaks?
Re: GitLeaks – Search engine for exposed secrets on GitHub
#6Didn't take long from the proggit/HN 'removed password' post to gitleaks: $ whois gitleaks.com | grep Creation Creation Date: 06-feb-2017
GitHub searches that expose secrets have been posted numerous times already in the past.
Re: GitLeaks – Search engine for exposed secrets on GitHub
#7What a shame that you had to expose everyone's mistakes like this in such a blanket fashion.
You could've taken the moral high ground and created a reverse-search such as HaveIBeenPwned[0], whereby you check repos you own.
I hope this gets taken down because the potential for abuse is ripe.
Re: GitLeaks – Search engine for exposed secrets on GitHub
#8Why not use your knowledge of these exposed secrets for good? You know which repo they're coming from, it'd be super simple to let the owner know rather than potentially costing them time and money. It also seems as though the only use of this site is to capitalise on other people's mistakes? It looks like you're just handing over leaked data to people who will definitely abuse it, which seems to go against your core…
I agree with what you wrote. My two cents are: seems that getting attention goes against being nice to others, such a shame living in such a society.
Re: GitLeaks – Search engine for exposed secrets on GitHub
#9What a shame that you had to expose everyone's mistakes like this in such a blanket fashion. You could've taken the moral high ground and created a reverse-search such as HaveIBeenPwned[0], whereby you check repos you own. I hope this gets taken down because the potential for abuse is ripe. [0] - https://haveibeenpwned.com
that's such a great idea, although I think people that would sign up for this service would know not commit credentials
Re: GitLeaks – Search engine for exposed secrets on GitHub
#10I think this is great work, the secrets are already scraped and compromised anyway. Good way to make it more clear. It reminds me of https://twitter.com/dumpmon on Twitter.