Exploiting Leaked Credentials - How python code is leaking millions of secrets
summary
A new GitGuardian scan finds 10 million secrets in public repos (a 67% jump), with about 2.1 million secrets in .py files across 1.3 million files. Discovery happens via GitHub search and the GitHub events API (public push and publicize events), plus bots using TruffleHog/Gitleaks patterns; an in-session honeytoken records 13 exploitation attempts during the talk. Real-world cascades include the Codecov supply-chain incident, Twitch and Toyota leaks. Fixes used: revoke/rotate keys, secrets managers, git hooks, BFG/GG Shield scans.
AI-written summary · about
chapters (8)
- 0:00Introduction to secrets leakage
- 2:54State of Secrets Brawl report
- 9:33How attackers find leaked secrets
- 13:02Private code is not safe either
- 19:27Why secrets end up in code
- 21:56Managing secrets effectively
- 24:43Live experiment results
- 25:26Q&A session
related talks
33mGaining initial access by exploiting leaked credentials
48mHow Source Code is Revealing our Secrets
40mDue to Less Pollution, Secrets Stored on the Cloud are Now Clearly Visible
35mGit those secrets out your repos!
53mAre your secrets secure? How mobile applications are leaking millions of credentials
30mWhoops! I Accidentally Leaked My Credentials (again)
24mHow to Find if Your Developers are Leaking Secrets?
33mWhoops! I Accidentally Leaked My Cloud Keys