Security Considerations in API Docs
summary
Presents evidence that many public API documentation repositories leak real credentials (about 30% in a 200-repo sample) by using a regex-based scanner plus GitHub code search to find exposed secrets and live test tokens. Describes a practical defense implemented in Node.js: a CI markdown linter plugin that blocks pull requests containing secrets and a lightweight redaction script; deploying these checks reduced detectable leaks from ~30% to under 1% within a week.
AI-written summary · about
chapters (5)
- 0:00API security intro
- 7:58Common API vulnerabilities
- 13:07Secure docs best practices
- 18:44Real-world security examples
- 20:48Summary
related talks
33mGaining initial access by exploiting leaked credentials
24mHow to Find if Your Developers are Leaking Secrets?
48mHow Source Code is Revealing our Secrets
30mWhoops! I Accidentally Leaked My Credentials (again)
31mExploiting Leaked Credentials - How python code is leaking millions of secrets
40mDue to Less Pollution, Secrets Stored on the Cloud are Now Clearly Visible
31mThe internet is broken: breaking down the software supply chain
27mHidden Dangers Of AI In Developer Workflows: Navigating... with Dwayne McDaniel