Skip Navigation

InitialsDiceBearhttps://github.com/dicebear/dicebearhttps://creativecommons.org/publicdomain/zero/1.0/„Initials” (https://github.com/dicebear/dicebear) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)P

peternovakdev

@ peternovakdev @programming.dev

Posts
2
Comments
8
Joined
2 mo. ago

  • We made 75 private repos public on a timer. The internet noticed in 6 minutes.

    Jump

  • Fair to call out. This did come out of me building a product in the space, and I'd rather disclose that than bury it. The method and numbers are real, happy to get into either.

  • We made 75 private repos public on a timer. The internet noticed in 6 minutes.

    Jump

  • The 6 minutes was the earliest contact, not the typical one. Most first hits came around 8 minutes. I agree there has to be something delaying repos showing up. I was expecting even 60 seconds of exposure to be enough to get caught.

  • We made 75 private repos public on a timer. The internet noticed in 6 minutes.

    Jump

  • That matches what I saw. One of the actors was a Hetzner host running TruffleHog, and the busiest was a harvester on two OVH IPs doing nothing but GetCallerIdentity checks. So yes, someone is polling the public events feed and scanning whatever shows up. The keys got found the moment the repo was visible to that feed.

  • Programming @programming.dev
    peternovakdev @programming.dev

    We made 75 private repos public on a timer. The internet noticed in 6 minutes.

    codatus.com /blog/we-leaked-75-aws-keys-to-see-who-watches-public-repos/

  • I checked whether well-known dev tools companies actually require code review before merging to main. Most don't

    Jump

  • Don’t have data to answer that, but it’s a very good question. Weighting it by the number of contributors would make the data more honest, and probably more interesting. Will consider a follow-up based on this angle - thanks!

  • I checked whether well-known dev tools companies actually require code review before merging to main. Most don't

    Jump

  • That's fair, and it's a real limit of measuring GitHub config. If a team runs review or merge gating in a separate tool, or mirrors to GitHub from somewhere that's their actual source of truth, the scan won't see it and they'd look unprotected when they aren't. The finding is really about repos where GitHub is the place the work happens, and even then it's public repos only. Worth saying plainly so the number isn't read as more than it is.

  • I checked whether well-known dev tools companies actually require code review before merging to main. Most don't

    Jump

  • Good distinction. If it's useful, GitHub lets you require checks and still grant a bypass for specific people or teams, so the hard rule and the emergency escape hatch can coexist, and the scan reads that as passing. Could be you've already weighed that, in which case ignore me.

  • I checked whether well-known dev tools companies actually require code review before merging to main. Most don't

    Jump

  • Right? The part that surprised me was that most of them turn branch protection ON and then don't require any check to pass. So the gate is there, it just doesn't gate anything. Makes me wonder if private repos are the same or if the public ones just get less attention.

  • Programming @programming.dev
    peternovakdev @programming.dev

    I checked whether well-known dev tools companies actually require code review before merging to main. Most don't

    codatus.com /blog/only-2-of-128-yc-backed-dev-tools-companies-block-unchecked-merges/