The blog of GitGuardian, a secrets detection company, covering leaked credentials, Git security, and Docker best practices.
HN links it for guidance on remediating exposed secrets and open-sourcing safely, and cites its finding that most leaked secrets stay valid.
* The hardening of images is pretty important: https://blog.gitguardian.com/how-to-improve-your-docker-containers-security-cheat-sheet/
* Working out/testing how upgrades can be made to ingresses without downtime
* Designing and testing SSL cert rotation
* Having a strategy for image version updates (e.g. not using "latest" but how to decide when an upgrade to a newer image is or isn't acceptable)
* How to super-optimise layering or image builds including ADD vs COPY, realising that copying everything at once usually breaks this, working out where/how to perform things like OS updates
* How to correctly inject build versions from CI into the docker executable
* How to use databases inside containers with e.g. schema and data updates
* The various kubernetes network options
* How DNS works in kubernetes (and when it doesn't)
* Debugging containers that fail to start or run
* Using probes correctly and understanding ready vs liveness vs startup
* How to check for node health dynamically to control external load balancers
* Using pod anti-affinity to balance pods across all nodes
* Understanding how to lof effectively from the container
Those are a few I can think of off the top of my head.
Basically, rotate as soon as you can* and start looking through your AWS logs and setting to see if any services you don't recognize have been spun up. Is you think you have been attacked or see stuff you did not spin up, contact AWS support ASAP!
*Do NOT just revoke keys if it is in a production system where other people are working or are depending on. Talk to your team and figure out what the remediation process is internally and follow that!
If you are working by yourself and no one is relying on services this key is associated with, then yeah, just revoke and replace ASAP.
Here are a couple blogs that cover what you are looking for as well
https://blog.gitguardian.com/leaking-secrets-on-github-what-to-do/
https://blog.gitguardian.com/thinking-like-a-hacker-aws-keys-in-private-repos/
It was just an example. It used to be fairly common for people to sync some of their dotfiles via git, and from time to time someone would leak a directory that contained sensitive data without them realizing it. I'd guess things like tokens used by cli tools were more common than whole .ssh directories, but I'm sure both happened.
Not quite the same thing, but also a leak: https://blog.gitguardian.com/github-exposed-private-ssh-key/
I guess all these folks saying professionals would never make a mistake like this will also have insulting names for github engineers. :shrug
If the numbers look suspicious to you, I would suggest you check what is found more specifically about your company/organization.
GitGuardian can provide an automatic audit of your company-specific leaks we found on GitHub. Just ask: https://www.gitguardian.com/complimentary-audit-secrets-leaks-public-github
More details on how it works: https://blog.gitguardian.com/github-secrets-leak-free-audit/
Here's a checklist [1] (again, from gitguardian) of steps to follow before open-sourcing projects and [2] a guide on how to remediate hardcoded/exposed secrets.
[1] https://blog.gitguardian.com/safely-open-source-software-best-practices
[2] https://blog.gitguardian.com/leaking-secrets-on-github-what-to-do/
https://blog.gitguardian.com/crappy-code-crappy-copilot/
https://news.ycombinator.com/item?id=39168105
There is plenty of evidence that none of this code is good. Github is now deep into the MS copilot shitty hype machine cycle. You have been warned that M$ gonna M$.