What will happen when you commit secrets to a public Git repo?
1–10 of 68 posts
Re: What will happen when you commit secrets to a public Git repo?
#2Nice honey pot experiment.
Re: What will happen when you commit secrets to a public Git repo?
#3Nice honey pot experiment.
Thanks!
Re: What will happen when you commit secrets to a public Git repo?
#4Thanks for sharing. Did you also investigate what they actually did with the keys?
Re: What will happen when you commit secrets to a public Git repo?
#5[deleted]
Re: What will happen when you commit secrets to a public Git repo?
#6Thanks for sharing. Did you also investigate what they actually did with the keys?
You mean adversaries? No. For token generation I used https://canarytokens.org/ so the only information I got was abou triggering the token, but not the context in which it was triggered.
BTW. GitHub (apart from GitGuardian) also has Secret Scanning feature [1] that basically allows the provider to act on the leaked secret. Amazon is integrated and it should invalidate and inform the owner but this also went to Thinkst, not me, so I don't know if it was actually invalidated and alerted.
[1] https://developer.github.com/partnerships/secret-scanning/
Re: What will happen when you commit secrets to a public Git repo?
#7Cool experiment!
I PM the secret scanning team at GitHub and wanted to mention what GitHub did behind the scenes here. GitHub scans every commit to a public repo for secrets one of our secret scanning partners may have issued. We forward those candidate secrets to the issuing partner, and they take action. In some cases they auto-revoke the secret (AWS normally does this, I believe), in some cases they notify the user, and in some cases the response is configurable.
I checked that GitHub detects these tokens myself - within 1 second of the commit GitHub had notified AWS and Slack of the leak. AWS and Slack will then have taken action and informed the token owner, which in this case is Thinkst Canary, rather than Andrezj (the OP). I believe AWS normally auto-revoke, but they may have a custom setup with Thinkst Canary's tokens that allows Thinkst to continue to monitor them even once compromised.
Finally, GitHub actually delays the indexing of our search by a couple of seconds to ensure that, for normal cases, our secret scanning partners have time to take action before anyone else can find the tokens.
We're always looking to make secret scanning at GitHub better, so feedback as always welcome. It's also fascinating (and validating!) to see what happens to exposed tokens.
* List of GitHub secret scanning partners: https://docs.github.com/en/free-pro-team@latest/github/admin...
* Thnkst Canary tokens: https://www.canarytokens.org/
Re: What will happen when you commit secrets to a public Git repo?
#8Cool experiment! I PM the secret scanning team at GitHub and wanted to mention what GitHub did behind the scenes here. GitHub scans every commit to a public repo for secrets one of our secret scanning partners may have issued. We forward those candidate secrets to the issuing partner, and they take action. In some cases they auto-revoke the secret (AWS normally does this, I believe), in some cases they notify the use…
Awesome, thanks for the background information!
Re: What will happen when you commit secrets to a public Git repo?
#9Cool experiment! I PM the secret scanning team at GitHub and wanted to mention what GitHub did behind the scenes here. GitHub scans every commit to a public repo for secrets one of our secret scanning partners may have issued. We forward those candidate secrets to the issuing partner, and they take action. In some cases they auto-revoke the secret (AWS normally does this, I believe), in some cases they notify the use…
Why not refuse to publish a detected secret at all until the repo owner takes an action to allow it?
Re: What will happen when you commit secrets to a public Git repo?
#10Cool experiment! I PM the secret scanning team at GitHub and wanted to mention what GitHub did behind the scenes here. GitHub scans every commit to a public repo for secrets one of our secret scanning partners may have issued. We forward those candidate secrets to the issuing partner, and they take action. In some cases they auto-revoke the secret (AWS normally does this, I believe), in some cases they notify the use…
Why not refuse to publish a detected secret at all until the repo owner takes an action to allow it?
Think about it in terms of incentives and nudges.