GitHub commit search: “remove password”

Post by Ajedi32 » Wed, Feb 15, 2017, 2:09 PM UTC

TeMPOraL wrote: post #118

Klathmon wrote: post #46

Earlier quoted context omitted.

They do this for all of their own API keys already. They not only notify you but instantly invalidate a key pushed to a public repo. Annoyingly there is no way to turn it off even when you explicitly want to share an API key knowingly. But i'm more than fine with needing to "obfuscate" an API key or manage secrets correctly knowing it saves TONS of people.

Split it to parts and concatenate it, then? $key = "BAAD" + "F00D" + "CAFE" + "BABE";

Post by kxait » Wed, Feb 15, 2017, 2:15 PM UTC

Post by aargh_aargh » Wed, Feb 15, 2017, 2:16 PM UTC

LeonidBugaev wrote: post #23

If you found a similar mistake in your repository, you can delete commit from history using: `git rebase --onto ^ `. Or if you want actually rewrite it, see git rebase -i` documentation.

Post by dvdgsng » Wed, Feb 15, 2017, 2:19 PM UTC

nailer wrote: post #90

therealasdf wrote: post #87

For anyone wondering, if you want to remove a file or secret you've already committed, you can use BFG Repo-Cleaner to go through your commit history and completely remove any trace of it. https://rtyley.github.io/bfg-repo-cleaner/

+1. Requires Java but BFG Repo Cleaner is the only app I've ever felt worth installing the JVM for.

Post by Vinnl » Wed, Feb 15, 2017, 2:20 PM UTC

_pctq wrote: post #34

shawabawa3 wrote: post #18

Earlier quoted context omitted.

It is customer fault. However it should be pretty easy for them to set up a script to search github for this kind of stuff and automatically invalidate keys

And this would be a cool feature from github too. A link mentioning "we found something in your code that looks like a secret, please know people will use it."