Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitLeaks – Search engine for exposed secrets on GitHub

gitleaks.com

Post reply on HN
Print view View original

31–40 of 63 posts

Re: GitLeaks – Search engine for exposed secrets on GitHub

#31

Post by rmc »

koolba wrote: post #14
nitza wrote: post #5

Why not use your knowledge of these exposed secrets for good? You know which repo they're coming from, it'd be super simple to let the owner know rather than potentially costing them time and money. It also seems as though the only use of this site is to capitalise on other people's mistakes? It looks like you're just handing over leaked data to people who will definitely abuse it, which seems to go against your core…

Would it be considered spamming to pull the email address of the commits and send them an automated email?

Would it be against the GitHub terms of service to do such an email?

Re: GitLeaks – Search engine for exposed secrets on GitHub

#33

Post by runholm »

koolba wrote: post #3

Are there any legal ramifications for operating something like this? I know it's publicly available info but since the original creator of the information didn't directly give it to you, do you still have the usual immunity given to service providers? Also, just because something is on $PUBLIC_URL doesn't mean the copyright would allow you redistribute it. I'm sure a lot of these projects have either a private licens…

Is this different from any other search engine? They just index web pages and let users search the data?

Re: GitLeaks – Search engine for exposed secrets on GitHub

#34

Post by ascendantlogic »

This is one of those times where you ask yourself "I know I can do this, but should I?". Most of us know we can search GitHub for stuff like AWS_ACCESS_KEY_ID but putting the work into creating a productized interface for it seems a bit beyond the pale to me.

Re: GitLeaks – Search engine for exposed secrets on GitHub

#35

Post by innerspirit »

sschueller wrote: post #29
mkagenius wrote: post #22

Woah, too many negative comments here. We wanted to model it like Shodan where we would provide a searchable interface for secrets on the web, starting with GitHub. We are removing the search functionality and account upgrades right now until we can come up with a better solution to inform people about secret leaks. For now, you can simply use the existing Check my GitHub button to scan your public repos.

The data is public, there is absolutely nothing wrong with this and you should put it back online.

Most of the data on there is not meant to be public. It's just a tool to abuse people's ignorance, disguised as a "research tool".

Re: GitLeaks – Search engine for exposed secrets on GitHub

#36

Post by sublimino »

Open source alternatives for Git repos (ideally run in the pipeline):

https://github.com/dxa4481/truffleHog - "Searches through git repositories for high entropy strings, digging deep into commit history"

https://github.com/ezekg/git-hound - "Hound is a Git plugin that helps prevent sensitive data from being committed into a repository by sniffing potential commits against PCRE regular expressions"

https://github.com/michenriksen/gitrob - "The tool will iterate over all public organization and member repositories and match filenames against a range of patterns for files that typically contain sensitive or dangerous information"

https://github.com/awslabs/git-secrets - "Prevents you from committing passwords and other sensitive information to a git repository"

Re: GitLeaks – Search engine for exposed secrets on GitHub

#37

Post by dknecht »

mkagenius wrote: post #22

Woah, too many negative comments here. We wanted to model it like Shodan where we would provide a searchable interface for secrets on the web, starting with GitHub. We are removing the search functionality and account upgrades right now until we can come up with a better solution to inform people about secret leaks. For now, you can simply use the existing Check my GitHub button to scan your public repos.

HN can be an echo chamber. Keep it online. The world is bigger then HN.

Re: GitLeaks – Search engine for exposed secrets on GitHub

#39

Post by shiven »

mkagenius wrote: post #22

Woah, too many negative comments here. We wanted to model it like Shodan where we would provide a searchable interface for secrets on the web, starting with GitHub. We are removing the search functionality and account upgrades right now until we can come up with a better solution to inform people about secret leaks. For now, you can simply use the existing Check my GitHub button to scan your public repos.

Why not use this info to assign a "leak" score to repos that have such info? Don't give anyone the details via a search interface but do rank the various public repos by the number of such leaks. That way the repo owners get a fair warning and a reputation hit without exposing the details of what is being leaked.

Re: GitLeaks – Search engine for exposed secrets on GitHub

#40

Post by [deleted] »

mkagenius wrote: post #22

Woah, too many negative comments here. We wanted to model it like Shodan where we would provide a searchable interface for secrets on the web, starting with GitHub. We are removing the search functionality and account upgrades right now until we can come up with a better solution to inform people about secret leaks. For now, you can simply use the existing Check my GitHub button to scan your public repos.

[deleted]
Post reply on HN