21–30 of 123 posts
Does anyone know what to look for in the github audit logs, exactly?
Try here: https://github.com/settings/security-log
/settings/audit-log" rel="nofollow">https://github.com/organizations//settings/audit-l...
... but the real question is what would malicious activity look like, exactly?
Interesting I had an OLD project associated with a Gmail email address that would send emails in some cases. Yesterday I got a notification that someone tried logging into that Gmail account. The password was hard coded in the code…
Ah yes, the Friday night security incident drop.
Credentials and other secrets, like API keys, should never be hard-coded in the source code repo. Use some sort of secrets management or configuration for that kind of stuff.
Ughh here I was at 1:30AM after a hard week, checking the news one last time before going to bed, and see this. I hate this dang industry and regret ever becoming a tech lead. I know the Heroku engineers have it worse and all, but just venting.
Does anyone know what to look for in the github audit logs, exactly?
If you email GitHub support they can pull out detailed logs from oauth app interactions from their internal tools.
I would expect the GH security team to have relevant queries ready by now, maybe even do some proactive queries and start alerting anyone who had suspicious activity. (But this is just how I'd do it I have no special insight if they are doing this or something else).