41–47 of 47 posts
The first one that comes to my mind is shhgit (https://github.com/eth0izzle/shhgit)
Anyone can self host it and then add multiple GitHub Dev keys to it. Then this can be used to monitor GitHub commits being done, majority of which can be categorized as "secrets".
There are bots that scan GitHub for credentials and private keys. Sorry that happened to you, I hope it wasn't a lot of money. Considered adding files like that to .gitignore in the future.
Actually already added to .gitignore file but then realized that .js files are not being discarded by .gitignore
I think your colleague cloned the repo, and he had wallet stealing malware in his PC, which probably automatically stole it within milliseconds of the clone happening.
This is a horrifying scenario.
I think your colleague cloned the repo, and he had wallet stealing malware in his PC, which probably automatically stole it within milliseconds of the clone happening.
This is a horrifying scenario.
There are bots that scan GitHub for credentials and private keys. Sorry that happened to you, I hope it wasn't a lot of money. Considered adding files like that to .gitignore in the future.
Earlier quoted context omitted.
What he is doing should have been secure. The question is valid. How were the keys exposed from a private repo?
"Secure" is kind of a relative term, it only exists with regard to a threat model and a likely spectrum of attacks. Simply having the key in plaintext on a developer PC connected to the regular internet is fairly low-security to start with; there are all sorts of opportunities for coincidental compromise that may have exposed it directly from his PC or his collaborator's PC.
I hope you're enjoying being your own bank and in full control of your resources. Maybe you need to ask your bank (yourself) about your security policies. /s (Information security is hard and you only have to make a mistake once.)
What he is doing should have been secure. The question is valid. How were the keys exposed from a private repo?
Sure, but using any third party is inviting a layer of risk. Banks get hacked too. No system is without vulnerabilities. You decide which to trust, including your potentially error-prone self.