◄ ► | Editer | Départ | Admin | en de fr et | Se connecter

#6970 (Cr0c0 reports "Possible exposed secret" in book)

by Luc Saffre · in Developers

Résumé

I received this message (because a robot detected that there is a Google OAUTH key published in lino_book/projects/noi2/tests/demo_google_user.json):

Hi, I'm Cr0c0 — I run automated scans over public commits looking for leaked credentials, and this repo showed up.

Type: Google OAuth Token

Commit: 2...


This is a good-faith heads-up, nothing is expected of you. Once a key hits a public commit it's compromised, even if you delete it after (it stays in the git history). What matters: rotate it now, deleting the commit isn't enough.

I put together a short report for this repo — the exact line, every other credential I found in its history, and the revocation steps for this specific provider:

leakwatch.net/r/1H0jhguMfslJTXYx

No signup, nothing to install. Happy to walk through it right here in this thread instead if you prefer.

Concepts sous-jacents

Commentaires

  • 2 mois, 1 semaine ago by Luc Saffre about #6970 (Cr0c0 reports "Possible exposed secret" in book) : As the message says, there is nothing urgent to do, the key has just been marked as compromised in their database.
    But it shows that we should some day remove this key from the repository. And on CI the test would then simply skip, it would run only on a machine where the developer has done a few e...
  • 2 mois, 1 semaine ago by Luc Saffre about #6970 (Cr0c0 reports "Possible exposed secret" in book) : Created new Ticket #6970 (Cr0c0 reports "Possible exposed secret" in book).