Hacker News Reader

Comment by stefan_ | Hacker News Reader

Pretty sure GitHub runs a system that will automatically revoke every (AWS and other) key to ever become part of a repository.

View on HN

That evidently didn't happen here.

I do remember reading about that too though, maybe it missed it because it was JSON data not a variable definition or something?

https://docs.github.com/en/code-security/secret-scanning/sec...

I can't find anywhere that specifies the actual pattern though.

it wasn't stored on GitHub.

there's a json file on GitHub referencing the download of the source archive, stored on pypi infra.

in the tgz you can download from pypi you can find python code containing the secret.

https://github.com/orf/pypi-data/blob/main/release_data/i/h/...

Not in my experience dealing with customers who had AWS email them saying 'Hey, we found one of your keys on GitHub'.

I’ve worked on a team where Github was the one who reached out about a leaked AWS secret key, not AWS. They apparently usually do this a few minutes before the key makes it into their search index. It’s not much but it’s better than nothing.

They have the tools to do that.

You might be horrified by how many shitty developers want all the good guardrails GHE provides switched off, and how many managers will support them because they're a "superstar who gets things done".

Not automatically since that would lead to them getting sued, no?

Reply on news.ycombinator.com