Open source alternatives for Git repos (ideally run in the pipeline): https://github.com/dxa4481/truffleHog - "Searches through git repositories for high entropy strings, digging deep into commit history" https://github.com/ezekg/git-hound - "Hound is a Git plugin that helps prevent sensitive data from being committed into a repository by sniffing potential commits against PCRE regular expressions" https://github.com…
Thanks for the shout out! I was wondering what brought in the recent stargazers. Happy to share my commonly-used regexes.
I guess that's one way to get attention to your business. Instead of informing the owners of repositories by creating an issue, you create a search engine to expose them, and then ask to be paid for usage of this index? The only reason someone would want those secrets is to abuse them. This is basically the only use case for the data. Why do this? This is coming from "fallible.co" whose homepage says "Prevented 40 mi…
I strongly disagree with this reasoning. Yes, more people will burned by making these data more easily available to the public - but as a result of those people being burned, security for the community as a whole will be improved over time. An example of this is what happened with Facebook. Prior to 2013, most users logged in to Facebook without using HTTPS. A Firefox-based tool was released that sniffed for Facebook…
Why not just write a quick script to send them all an automated message/ticket a week before this is live and then run it on archived data? You can do both at the same time.