[Hackers]

Many developers make the mistake of exposing their API credentials, secrets, and sensitive info on their github repositories or other public codebases. Remember, even sharing an env file of secrets and keys in a private repo can be a security risk as it only takes 1 repo contributor being compromised to expose your credentials. Github tries to make it easier for devs and companies to stay secure by using a thing called 'secrets scanning' which can help identify any exposed values in your codebases.

Threat actors take advantage of developer negligence and mistakes by searching the web for public repos & finding exposed keys. They then use these credentials to access your otherwise secure integrations, customer data, and more. You should look into enabling Github secret scanning even if you are certain you have safely and securely uploaded your codebase. It's worth it to make sure you are protected.

[TooBurnt]

Good advice for anyone using git

[banonkiel]

I was on a couple of development-centered forums.

I spent a lot of time just going on to people posting about their new projects (mostly CRUD apps they made while learning lol)
and basically replied the same thing

"Properly configure your tokens and never push them to your repository, even if it's private"

[Hackers]

Good advice for anyone using git

I was on a couple of development-centered forums.

I spent a lot of time just going on to people posting about their new projects (mostly CRUD apps they made while learning lol)
and basically replied the same thing

"Properly configure your tokens and never push them to your repository, even if it's private"

yeah people need to be way more careful
threat actors will just use Google Dorks or other repo searches to find secrets eventually. It'll keep happening as long as people keep making this mistake.

[source]

instructions too hard, uploaded all api creds and db info

[happygonutty]

Many developers make the mistake of exposing their API credentials, secrets, and sensitive info on their github repositories or other public codebases. Remember, even sharing an env file of secrets and keys in a private repo can be a security risk as it only takes 1 repo contributor being compromised to expose your credentials. Github tries to make it easier for devs and companies to stay secure by using a thing called 'secrets scanning' which can help identify any exposed values in your codebases.

Threat actors take advantage of developer negligence and mistakes by searching the web for public repos & finding exposed keys. They then use these credentials to access your otherwise secure integrations, customer data, and more. You should look into enabling Github secret scanning even if you are certain you have safely and securely uploaded your codebase. It's worth it to make sure you are protected.

Wow! A new feature! I never knew GitHub would add a new feature like this. I always just gitignore the env files and just put samples on the end for sample purposes. 😎

[obsidiand]

Had a friend making a discord bot just for fun for our friends server and forgot to delete the key from the repository, one day had my phone with 500 notifications from discord because we were invaded by bots warning us about it ahah

[Hackers]

Wow! A new feature! I never knew GitHub would add a new feature like this. I always just gitignore the env files and just put samples on the end for sample purposes. 😎

yep, you are doing it right! That's what you should be doing :)

Had a friend making a discord bot just for fun for our friends server and forgot to delete the key from the repository, one day had my phone with 500 notifications from discord because we were invaded by bots warning us about it ahah

Lol sounds about right. at least it was a kind person warning your friend & not a malicious person.
This happens all the time I'm sure - they must find a lot to justify having a warning bot running.

[happygonutty]

yep, you are doing it right! That's what you should be doing :)

Yes, I am really paranoid with the systems I develop especially the env files since that is almost the heart of everything. 🙃