I accidentally pushed keys to github last year and got an email from HelpfulOwl letting me know they found them and to remove them.
That's an example of using this tech for good.
GitLeaks – Search engine for exposed secrets on GitHub
41–50 of 63 posts
Re: GitLeaks – Search engine for exposed secrets on GitHub
#42I don't think it's illegal or wrong to have that search, those mistakes are made by developers who aren't paying attention to security, and from experience those leaks will never be resolved UNTIL they get widely exposed, until then, lots of those people will just shrug it off.. you're actually doing a favour to the users who depend on those developers, you never know when the next leak will be and it might be stopped by forcing the developers to fix it. it's not about you, your service, nor the companies, developers who are leaking secrets like that, it's about the end users and people who are affected, my two cents, put the search back, expose it, it's already exposed and probably black hats already have the secrets and don't want to notify the devs of their mistakes. anyone else who disagrees with you doesn't really understand how big this is, your service is amazing and I totally appreciate the work you did, if someone thinks you're "getting attention" or "evil" they really are not looking at the big picture, the "evil" ones are the people who already have that leaked data and keep it for their personal use.
Re: GitLeaks – Search engine for exposed secrets on GitHub
#43Re: GitLeaks – Search engine for exposed secrets on GitHub
#44Woah, too many negative comments here. We wanted to model it like Shodan where we would provide a searchable interface for secrets on the web, starting with GitHub. We are removing the search functionality and account upgrades right now until we can come up with a better solution to inform people about secret leaks. For now, you can simply use the existing Check my GitHub button to scan your public repos.
The data is public, there is absolutely nothing wrong with this and you should put it back online.
I absolutely agree. Most of the negative comments on here are nothing more than apologists for incompetence. Like with all security research the solution is to expose the defect to the world. If people didn't want their passwords and keys exposed to the world then they shouldn't put them on public github for all the world to see.
It would be more helpful though if such a search engine could auto create an issue on github when exposed secrets come up in a search result.
Re: GitLeaks – Search engine for exposed secrets on GitHub
#45[deleted]
Re: GitLeaks – Search engine for exposed secrets on GitHub
#46Are there any legal ramifications for operating something like this? I know it's publicly available info but since the original creator of the information didn't directly give it to you, do you still have the usual immunity given to service providers? Also, just because something is on $PUBLIC_URL doesn't mean the copyright would allow you redistribute it. I'm sure a lot of these projects have either a private licens…
Is this different from any other search engine? They just index web pages and let users search the data?
I'm not sure but I think intent matters. That's how they go after torrent sites right because they're "just search engines"?
Re: GitLeaks – Search engine for exposed secrets on GitHub
#47Open source alternatives for Git repos (ideally run in the pipeline): https://github.com/dxa4481/truffleHog - "Searches through git repositories for high entropy strings, digging deep into commit history" https://github.com/ezekg/git-hound - "Hound is a Git plugin that helps prevent sensitive data from being committed into a repository by sniffing potential commits against PCRE regular expressions" https://github.com…
A lot of those require lists of regexes-- is there a canonical list of secret regexes somewhere?
Re: GitLeaks – Search engine for exposed secrets on GitHub
#48Bad guys already have scrapers like this, for years, so this is really not putting anyone at any additional risk. They're already in danger, just not aware of it. Even script-kiddies have cheap tools available to scan repos easily. As I see it the only new angle here is that this service lets ordinary users and other interested parties search for the f* ups and (if they care enough) let the project maintainers know about it.
Re: GitLeaks – Search engine for exposed secrets on GitHub
#49I think a more ethical way to go forward with this would be the haveibeenpwned way, where you can search your email and see where your stuff has been leaked instead of a searchable index of leaks.
Problem is that often project owners will not know/care about joining such services. Unlike the passwords, project's security is a matter of interest for a much wider public (all current and the potential future users), but if you let anyone subscribe to any leak than you are back at square one, cause bad guys can do it too.
Re: GitLeaks – Search engine for exposed secrets on GitHub
#50Earlier quoted context omitted.
There are non-abusive uses of this kind of data, e.g. security researchers, or IT departments outsourcing credential leak scanning, etc.. Also, notifying via a GitHub issue is, in my opinion, a terrible idea. GitHub has no concept of a security issue viewable only to the repo maintainers, so filing a public issue might make things worse (by calling public attention to it). A paid search engine without any notificatio…
If posting individual issues in each project, likely to be seen first by contributors is a bad idea, how is creating a paid search engine likely to be used by people who specifically want to find secrets and not likely to be used/seen by contributors a good thing?
I didn't say it was a good thing (or a bad thing), only that there are legitimate use cases and that the suggested notification method would be, in my opinion, terrible security practice...