I think a more ethical way to go forward with this would be the haveibeenpwned way, where you can search your email and see where your stuff has been leaked instead of a searchable index of leaks.
GitLeaks – Search engine for exposed secrets on GitHub
21–30 of 63 posts
Re: GitLeaks – Search engine for exposed secrets on GitHub
#22Woah, too many negative comments here. We wanted to model it like Shodan where we would provide a searchable interface for secrets on the web, starting with GitHub.
We are removing the search functionality and account upgrades right now until we can come up with a better solution to inform people about secret leaks. For now, you can simply use the existing Check my GitHub button to scan your public repos.
Re: GitLeaks – Search engine for exposed secrets on GitHub
#23I guess that's one way to get attention to your business. Instead of informing the owners of repositories by creating an issue, you create a search engine to expose them, and then ask to be paid for usage of this index? The only reason someone would want those secrets is to abuse them. This is basically the only use case for the data. Why do this? This is coming from "fallible.co" whose homepage says "Prevented 40 mi…
There are non-abusive uses of this kind of data, e.g. security researchers, or IT departments outsourcing credential leak scanning, etc..
Also, notifying via a GitHub issue is, in my opinion, a terrible idea. GitHub has no concept of a security issue viewable only to the repo maintainers, so filing a public issue might make things worse (by calling public attention to it). A paid search engine without any notification is probably worse, but maybe they are emailing the repo's committers? They may even be embargoing the search results for a period of time.
Re: GitLeaks – Search engine for exposed secrets on GitHub
#24Sorry OP, but this is pretty terrible idea. I know the secrets are already out there, but the least that could be done is let the user know about it.
I am glad to see the search was taken down. There's nothing wrong with the search, but a better use of it would be to educate and inform. I'd be curious to see which kinds of developers are the most likely to leak sensitive data.
Re: GitLeaks – Search engine for exposed secrets on GitHub
#25Huh, that was quick!
Re: GitLeaks – Search engine for exposed secrets on GitHub
#26Woah, too many negative comments here. We wanted to model it like Shodan where we would provide a searchable interface for secrets on the web, starting with GitHub. We are removing the search functionality and account upgrades right now until we can come up with a better solution to inform people about secret leaks. For now, you can simply use the existing Check my GitHub button to scan your public repos.
I don't have a problem with it. The only reason you are getting negative comments is that there will be a few HN members biting their nails.
Re: GitLeaks – Search engine for exposed secrets on GitHub
#27I guess that's one way to get attention to your business. Instead of informing the owners of repositories by creating an issue, you create a search engine to expose them, and then ask to be paid for usage of this index? The only reason someone would want those secrets is to abuse them. This is basically the only use case for the data. Why do this? This is coming from "fallible.co" whose homepage says "Prevented 40 mi…
There are non-abusive uses of this kind of data, e.g. security researchers, or IT departments outsourcing credential leak scanning, etc.. Also, notifying via a GitHub issue is, in my opinion, a terrible idea. GitHub has no concept of a security issue viewable only to the repo maintainers, so filing a public issue might make things worse (by calling public attention to it). A paid search engine without any notificatio…
Their FAQ indicates they update the index every two months, but no information on what they do with the data in the meantime.
Ideally this scanner would be a feature of a Github or a Bitbucket or a Gitlab, etc, itself. They could've decided to contact them to add this as a feature, or decided to contact repository owners, but instead they decided to sell the data publicly. Real shame.
Re: GitLeaks – Search engine for exposed secrets on GitHub
#28Why not use your knowledge of these exposed secrets for good? You know which repo they're coming from, it'd be super simple to let the owner know rather than potentially costing them time and money. It also seems as though the only use of this site is to capitalise on other people's mistakes? It looks like you're just handing over leaked data to people who will definitely abuse it, which seems to go against your core…
Would it be considered spamming to pull the email address of the commits and send them an automated email?
I suspect it would be easy to secure GitHub's cooperation in this, but almost certainly not for money or via a black box.
Re: GitLeaks – Search engine for exposed secrets on GitHub
#29Woah, too many negative comments here. We wanted to model it like Shodan where we would provide a searchable interface for secrets on the web, starting with GitHub. We are removing the search functionality and account upgrades right now until we can come up with a better solution to inform people about secret leaks. For now, you can simply use the existing Check my GitHub button to scan your public repos.
The data is public, there is absolutely nothing wrong with this and you should put it back online.
Re: GitLeaks – Search engine for exposed secrets on GitHub
#30I guess that's one way to get attention to your business. Instead of informing the owners of repositories by creating an issue, you create a search engine to expose them, and then ask to be paid for usage of this index? The only reason someone would want those secrets is to abuse them. This is basically the only use case for the data. Why do this? This is coming from "fallible.co" whose homepage says "Prevented 40 mi…
There are non-abusive uses of this kind of data, e.g. security researchers, or IT departments outsourcing credential leak scanning, etc.. Also, notifying via a GitHub issue is, in my opinion, a terrible idea. GitHub has no concept of a security issue viewable only to the repo maintainers, so filing a public issue might make things worse (by calling public attention to it). A paid search engine without any notificatio…
If posting individual issues in each project, likely to be seen first by contributors is a bad idea, how is creating a paid search engine likely to be used by people who specifically want to find secrets and not likely to be used/seen by contributors a good thing?