4 ms·
How would you scan for your api keys on repos outside of your organization? I assumed this was a dev’s personal repo.
by Everdred2dx 1y ago
How would you scan for your api keys on repos outside of your organization? I assumed this was a dev’s personal repo.
- kalkin 1y agohttps://docs.github.com/en/code-security/secret-scanning/secret-scanning-partnership-program/secret-scanning-partner-program https://docs.github.com/en/code-security/secret-scanning/sec... is one option
- Everdred2dx 1y agoNeat. Thanks!
- squigz 1y agoWell 1 option is the service from TFA. https://www.gitguardian.com/monitor-internal-repositories-for-secrets https://www.gitguardian.com/monitor-internal-repositories-fo...
- romellem 1y agoThe company I work for does this. I recently pushed an update to a personal repo that just contained a keyword match (the push included a dictionary.txt file which happened to include the company name) which flagged a review.
- mcdwayne 1y agoThis was on public GitHub, which anyone can scan for anything. Their API is a firehose you can consume: https://api.github.com/events https://api.github.com/events GitGuardian's public report on secrets sprawl talks about their methodology of scanning any commit https://www.gitguardian.com/state-of-secrets-sprawl-report-2025 https://www.gitguardian.com/state-of-secrets-sprawl-report-2...