GitHub has announced the launch of a free service to track random publication of confidential data in repositories, such as encryption keys, database passwords, and API access tokens. Previously, this service was available only to participants in the beta testing program, but it is now being provided without restrictions to all public repositories. To enable the check for your repository, you should activate the 'Secret scanning' option in the 'Code security and analysis' section of the settings.
More than 200 templates have been implemented for identifying various types of keys, tokens, certificates, and credentials. The search for leaks occurs not only in the code but also in issues, descriptions, and comments. To eliminate false positives, only reliably identifiable types of tokens are checked, covering more than 100 different services, including Amazon Web Services, Azure, Crates.io, DigitalOcean, Google Cloud, NPM, PyPI, RubyGems, and Yandex.Cloud. Additionally, alerts are supported for the detection of self-signed certificates and keys.
In January, during an experiment, 14,000 repositories using GitHub Actions were analyzed. As a result, secret data was found in 1,110 repositories (7.9%, or almost one in twelve). For example, the repositories revealed 692 GitHub App tokens, 155 Azure Storage keys, 155 GitHub Personal tokens, 120 Amazon AWS keys, and 50 Google API keys.
Source: opennet.ru
