Hacker News Reader

If you commit your AWS secrets/tokens, or similar, inside a python script it will now be discovered by github automatically.

They have integrations with a bunch of services to recognize the tokens, and disable them. This means malicious users can't copy/paste them, spin up servers and leave you with a big bill. (Ideally, of course it could still happen, but the aim is to prevent that kind of thing.)

View on HN

Though this has been true for a while, it's not what this announcement is about. This is specifically announcing automated scanning and reporting of PyPI keys, which if exposed, could allow a bad actor to distribute compromised Python packages via PyPi (e.g. pip)

And this is a potentially huge security issue. Think about all the systems software that relies on Python packages.

Reply on news.ycombinator.com