GitHub brings free secret scanning to all public repos • TechCrunch


Every developer knows that it’s a bad idea to hardcode security credentials into source code. Yet it happens and when it does, the consequences can be dire. Until now, GitHub only made its secret scanning service available to paying enterprise users who paid for GitHub Advanced Security, but starting today, the Microsoft-owned company is making its secrets scanning service available for all public GitHub repos for free.

In 2022 alone, the company notified partners in its secret scanning partner program of over 1.7 million potential secrets that were exposed in public repositories. The service scans repositories for over 200 known token formats and then alerts partners of potential leaks — and you can define your own regex patterns, too.

Image Credits: GitHub

“With secret scanning we found a ton of important things to address,” said David Ross, a staff security engineer at Postmates. “On the AppSec side, it’s often the best way for us to get visibility into issues in the code.”

Now, if you host your code on GitHub, the company will automatically notify you directly about leaked secrets in your source code. This also means that you will get alerts for secrets where there isn’t a partner to notify (maybe because you self-host your HashiCorp Vault, for example).

To begin using the service, you have to enable the feature in their GitHub security settings. However, the rollout of the service will be gradual and it will not be available to all users until the end of January 2023.

GitHub’s own tool is, of course, not the only service that will scan for leaked secrets. There are also open-source tools like gitLeaks (which can integrate with GitHub actions) and a plethora of security companies like Nightfall and CheckPoint’s Spectral, though their services tend to go well beyond secret scanning and are generally geared toward enterprises.

#GitHub #brings #free #secret #scanning #public #repos #TechCrunch


Related Posts

Marvel’s Blade Movie Delayed by Writer’s Strike

[ad_1] Marvel’s vampire hunter Blade is a fierce warrior but he may have finally met his match: labor unions. The upcoming, long-in-development reboot of the Marvel franchise…

How to Watch the Coronation of King Charles III Live

[ad_1] King Charles III officially shed his princedom when Queen Elizabeth II died, and the British royal’s new position will be formalized on May 6 in a coronation…

‘Quordle’ today: See each ‘Quordle’ answer and hints for May 6

[ad_1] If Quordle is a little too challenging today, you’ve come to the right place for hints. There aren’t just hints here, but the whole Quordle solution….

How to use a passkey instead of a password to sign into your Google account

[ad_1] Passwords have always been a necessary evil, giving you the choice of either using one that is too simple (so you can easily remember it) or…

Amazon quietly acquired audio content discovery engine Snackable AI to boost its podcast projects

[ad_1] Amazon quietly acquired New York-based audio content discovery engine Snackable AI last December to boost its podcast features, as first reported by New York Post. The…

Warhammer 40K’s New Tyranid Screamer-Killer Is a Great Update

[ad_1] A new edition of Warhammer 40K means new models—and for some of the 40-year-old wargaming franchise’s creatures and characters, that means updates they’ve not had in…

Leave a Reply

Your email address will not be published. Required fields are marked *