I found 39 Algolia admin keys exposed across open source documentation sites
1–10 of 62 posts
Re: I found 39 Algolia admin keys exposed across open source documentation sites
#2Great write up. Reminder that if you commit these to a Github Gist and the provider partners with GitHub for secrets scanning, they’ll rapidly be invalidated.
Re: I found 39 Algolia admin keys exposed across open source documentation sites
#3Interesting how many people already are playing with these API keys ? ;)
Re: I found 39 Algolia admin keys exposed across open source documentation sites
#4Great write up. Reminder that if you commit these to a Github Gist and the provider partners with GitHub for secrets scanning, they’ll rapidly be invalidated.
That's just a tautology.
"If the secrets issuer partners with X-corp for secret scanning so that secrets get invalidated when you X them, then when you X them the secrets will be invalidated".
The above is a true statement for all X.
Re: I found 39 Algolia admin keys exposed across open source documentation sites
#5[dead]
Re: I found 39 Algolia admin keys exposed across open source documentation sites
#6Great write up. Reminder that if you commit these to a Github Gist and the provider partners with GitHub for secrets scanning, they’ll rapidly be invalidated.
That's just a tautology. "If the secrets issuer partners with X-corp for secret scanning so that secrets get invalidated when you X them, then when you X them the secrets will be invalidated". The above is a true statement for all X.
[deleted]
Re: I found 39 Algolia admin keys exposed across open source documentation sites
#7Great write up. Reminder that if you commit these to a Github Gist and the provider partners with GitHub for secrets scanning, they’ll rapidly be invalidated.
That's just a tautology. "If the secrets issuer partners with X-corp for secret scanning so that secrets get invalidated when you X them, then when you X them the secrets will be invalidated". The above is a true statement for all X.
? Yes? Toomuchtodo is reminding the author (and other commenters), that github gists are one way to make sure secrets are secured / remediated before making a public post like this. Maybe not the most responsible whitehat action, but I can see it being useful in some cases where outreach is impractical / has failed.
Unfortunately, it doesn't look like Algolia has implemented this
Re: I found 39 Algolia admin keys exposed across open source documentation sites
#8So why hasn't the HomeAssistant docs page been nuked yet?
Re: I found 39 Algolia admin keys exposed across open source documentation sites
#9Man, talk about unnecessary graphs... ok graph 2 is maybe tolerable, although it's showing the popularity of the projects, not a metric of how many errors/vulnerabilities found in those projects.
I'm not a newspaper editor, but I think if this was an article for one, they'd also say the graphs are unnecessary. It smells of "I need some visual stuff to make this text interesting"...
Re: I found 39 Algolia admin keys exposed across open source documentation sites
#10Great write up. Reminder that if you commit these to a Github Gist and the provider partners with GitHub for secrets scanning, they’ll rapidly be invalidated.
That's just a tautology. "If the secrets issuer partners with X-corp for secret scanning so that secrets get invalidated when you X them, then when you X them the secrets will be invalidated". The above is a true statement for all X.
English is not formal logic.
In formal logic, that statement is true whether X is GitHub, or Lockheed-Martin, Safeway, or the local hardware store.
In English, the statement serves to inform (or remind) you that GitHub has a secret scanning program that many providers actually do partner with.