This repo should have had all types of static analysis running automatically.
Hell, GitHub has built in secret scanning. Apparently it was only set as the default for all new repos in March 2024[].
[] https://docs.github.com/en/code-security/secret-scanning/con...
How does the monetary value matters? A prototype is a prototype, a quick project to test some concept. If you wanna test some concept around large transfers, does that mean it's suddenly not a prototype?
> This repo should have had all types of static analysis running automatically.
Would that actually prevent this issue? So lets say they make the repository public, the static analysis tool begins screaming at the repo owner. Now, he has 2 minutes to transfer those funds somewhere (manually), before the thief automatically makes that transfer for them, to their own wallets.
Sounds like the guy just needed a hardware wallet instead of whatever they were doing. Who stores unencrypted wallet details containing $40K on disk?! Committed to git?!
Totally agree wallets with any real amount of money should probably not be on disk
Of course, an escape hatch (like adding some "I know what I am doing" tag to the commit) would be necessary but that's trivial to setup.