lumberjack24

3 tahun yang laludiscuss

Forest Admin's out-of-the-box admin panel + the convenience of the cloud, this is all developers ever wanted for their internal tools!

lumberjack24

3 tahun yang laludiscuss

To Casablanca, Morocco.

lumberjack24

3 tahun yang laludiscuss

Hey, maybe try running a GitGuardian [1] scan on all those repositories to look for hardcoded secrets. GitGuardian can also test in some cases if the secrets are valid or not, meaning you have to revoke and rotate them asap. I hope this helps.

[1] https://www.gitguardian.com/monitor-internal-repositories-fo...

Disclaimer: I work for GitGuardian.

lumberjack24

4 tahun yang laludiscuss

geez.

lumberjack24

4 tahun yang laludiscuss

“dark matter” sounds like marketing speak.

lumberjack24

4 tahun yang laludiscuss

well, they haven’t turned my building’s heating on yet.

lumberjack24

4 tahun yang laludiscuss

Here's a checklist [1] (again, from gitguardian) of steps to follow before open-sourcing projects and [2] a guide on how to remediate hardcoded/exposed secrets.

[1] https://blog.gitguardian.com/safely-open-source-software-bes... [2] https://blog.gitguardian.com/leaking-secrets-on-github-what-...

lumberjack24

4 tahun yang laludiscuss

Great idea, but hard to enforce. Just use a scanning CLI like TruffleHog, Gitleaks, or ggshield from GitGuardian to catch all sorts of hardcoded secrets.

lumberjack24

4 tahun yang laludiscuss

GitGuardian actually does this, it monitors an extended perimeter of devs and their personal/open-source repos for corporate secrets or keywords – https://www.gitguardian.com/monitor-public-github-for-secret...

lumberjack24

4 tahun yang laludiscuss

In the meantime, try ggshield cli https://github.com/GitGuardian/ggshield

lumberjack24

4 tahun yang laludiscuss

The access model on platforms like GitHub is flawed, a single account can be used for both professional and personal projects/repositories, leading to “fat finger” errors like this one here...

lumberjack24

4 tahun yang laludiscuss

I can’t help but wonder why qursān ended up being the final form instead of qursāl.

lumberjack24

4 tahun yang laludiscuss

That hardcoded secret in the powershell script really was the key to the Uber ride-hailing kingdom – https://blog.gitguardian.com/uber-breach-2022.

lumberjack24

4 tahun yang laludiscuss

open to referrals?

lumberjack24

4 tahun yang laludiscuss

lumberjack24