Credential mitigation in large-scale organizations
summary
Scans 250,000 repositories (5 TB compressed) by dumping blobs with git cat-file blobs, runs high‑throughput regex matching via Intel Hyperscan and uses 128 workers to finish a full enterprise scan in about four hours; adding a skip files >1MB filter cuts hot‑file noise and drops per‑repo scan time. Findings go through automated verification (try webhook or cloud API calls), daily revalidation, and an ownership‑mapped notification service so valid leaked credentials are tracked and escalated for rotation rather than buried in false positives.
AI-written summary · about
chapters (26)
- 0:00Intro
- 0:43Overview
- 3:17Defining the problem
- 5:00Extracting repository content
- 6:45Intel HyperScan
- 7:38Extracting repositories content
- 9:00Cloning repositories
- 9:56Scanning repositories
- 10:50Overview of findings
- 13:45Mitigation process
- 15:19False positives
- 16:36Notifications
- 17:26Revalidation
- 18:10Summary
- 18:24Open Questions
- 19:42Finding Bitcoin Key
- 20:41Key Sources
- 21:42Question from Randy
- 22:20Question from K Robots
- 22:42Scanning for credentials in repositories
- 23:51Question of the day
- 24:15Git
- 25:54Service applications
- 26:23API secret keys
- 27:41Realworld experience
- 29:01Does it work with GitHub Enterprise
related talks
30mWhoops! I Accidentally Leaked My Credentials (again)
27mLarge-Scale Exposure Of Orphaned Commits On Major Git Platforms
33mWhoops! I Accidentally Leaked My Cloud Keys
32mContainers Don't Keep Secrets: Scanning Docker Hub for Leaked Credentials and Private Keys.
35mGit those secrets out your repos!
32mGuardians of the Cloud Navigating the Depths of Cloud Threat Hunting
40mDue to Less Pollution, Secrets Stored on the Cloud are Now Clearly Visible
34mUnpacking Open Source Security in Public Repos & Registries