GitHub has announced the default inclusion of a mechanism to prevent confidential data from inadvertently entering public repositories, which developers might leave in the code. For example, configuration files containing database passwords, tokens, or API access keys can end up in a repository. Previously, scanning was done in passive mode and allowed detection of leaks that had already occurred in the repository. Now, the check is performed automatically at the publishing stage (git push) and results in a warning if commits are detected containing confidential data.
Over 250 templates have been implemented to detect various types of keys, tokens, certificates, and credentials. To minimize false positives, only guarantees of definable token types are checked, covering over 180 different services, including Amazon Web Services, Azure, Crates.io, DigitalOcean, Google Cloud, NPM, PyPI, RubyGems, and Yandex.Cloud. After a potential leak is detected, the developer is prompted to review the problematic code, address the leak, and re-commit or mark the block as false.
Source: opennet.ru
